Audit the message and action server

You enable auditing of the message and action server by monitoring the underlying Windows service which controls the message and action server, namely: OvEpMessageActionServer.

When you enable auditing for the message and action server, the message and action server writes entries to the custom application log OvConfigChanges each time an automatic or operator-initiated action is started or stopped and, in addition, each time a tool is used by an HPOM administrator or operator.

Each entry in the custom application log concerning an audit event for the message-action server contains the following information in the event header:

• Date:
  The date when the event occurred, for example: "1/23/2004"
• Time:
  The time at which the event occurred, for example: "10:18:52 AM"
• Type:
  The type of event that is being logged. For the message-action server, this is always set to the value: "Success Audit"
• User:
  The name of the HPOM user who initiated the event, for example:
  • "<domain>\Administrator" for operator-initiated actions, where the HPOM user is known
  • "NT AUTHORITY\SYSTEM" for automatic actions, where the HPOM user is not known and the action is performed under the System account
• Hostname:
  the hostname of the HPOM for Windows management server on which the event was logged
• Source:
  This value is always set to "OvEpMsgActSvr" for the HPOM message and action server.
• Category:
  This value is always set to "None"
• Event ID:
  A unique identifier for the logged event
• Description:
  A short description of the event, which has been logged, for example:

  (AS103) Tool execution task sent to agent on node "yoda.test.dom (<$OPC_MGMTSV>)". The tool execution will be started as user $AGENT_USER. The output will be sent to display "yoda.test.dom:0.0". The call ID of this tool execution task is "bb97111f-fd5b-4641-9678-57b1923ece56". The command call is "SetMgmtServer.exe /system /forced".

Exceptions and Restrictions

When you run an audit of the HPOM message and action server, note that the restrictions described in the following list apply to the type of events that can be logged:

• Automatic actions

  The message and action server does not either start or control automatic actions, which are configured to run on the managed node immediately after message generation, for example, when the target-node is defined as "<$MSG_NODE_NAME>" in the automatic action. This means that there is no way to log these automatic-action events as part of the audit of the Message-action Server.

  NOTE:
  Automatic actions that are set up to be run either on the HPOM management server (by using the setting <$OPC_MGMTSV> in the automatic action) or on a managed node other than the node which generates the message, are handled by the message and action server and, as a result, are logged in the custom event log used by the auditing feature.
• Operator-Initiated Actions

  Operator-initiated actions that are set up to be run on <$OPC_GUI_CLIENT> or on <$OPC_GUI_CLIENT_WEB> are executed directly from the GUI: they are not started or controlled by the message and action server, which means they do not appear in the audit log.

• Tools

  The message and action server does not start or control any tools, which run in the context of the HPOM console (as opposed to on the HPOM management server), even if the console is running on the HPOM management server. Tools which you configure to run in the context of the HPOM console are started and stopped directly from the GUI, which means that the start and stop events do not appear in the audit log.

Related Topics:

• Security audits
• Log files and event sources
• Enable and disable security audits