HP StorageWorks P9000 Command View Advanced Edition Suite Software 7.1.1 Administrator Guide (web) (TB581-96065, September 2011)

2. To determine the GUI operation used, compare the details of the audit log data with the contents
of Table 128 and look for a matching pattern.
Among the output audit log data, there will be evidence of many calls to Get-type operations.
These are frequently called to refresh the screen and cannot be attributed completely to user
actions. However, information that corresponds to operations such as creating, updating, and
deleting various resources in Tiered Storage Manager also exists in the audit log. Table 128
shows the main information for identifying log data of these operations. You can identify operations
performed by the user by looking for audit log data that has M in the key column. In the actual
audit logs, data for Get-type operations is output before and after the information shown in Table
128.
Users will specify names, such as a storage domain name and migration group name, during
user operations. However, audit log data output by the Tiered Storage Manager server might
output only IDs, such as storage domain IDs and migration group IDs, which are internally
managed by Tiered Storage Manager. In such cases, you cannot identify the name corresponding
to the ID simply by examining that particular audit log. However, if you search the audit log data
around that entry, you will find an audit log entry that has both the name and ID, and you can
use this information to identify the name.
In log data of creation tasks, both information items are output to the audit event information of
Create xx.
In log data of non-creation tasks, the GUI and CLI issue Get-type requests to acquire information
on the operation targets. Therefore, information on the operation targets of both the GUI and CLI
can be acquired by examining log data of Get-type requests.
The following example demonstrates how to find a corresponding name and ID, using a storage
domain refresh operation log as an example:
Example:
OP=(10,Get), Res=(20,SD), SD=(domainId,domainName)...(1) (Domain selection)
OP=(90,Refresh), Res=(20,SD), SD=(domainId)...(2) (Domain refresh)
When examining only the information in (2), you can only see the domainId, but when
examining the information in (1), you can also see the corresponding domainName.
Table 128 GUI operations and corresponding audit log data
Note
Additional
information
#
ResName
#
OpName
#
KeyGUI operation
----
LCGet
MLogging on
--
NumSDSDGet
M
Displaying a storage domain
list
--
SDSDGet
M
Displaying storage domain de-
tailed information
--
SDRSGet
--
--
SD, NumSTSTGet
MDisplaying a storage tier list
--
SD, STSTGet
M
Displaying storage tier detailed
information
--
SD, MGMGCreate
MCreating a migration group
--
SD, MGMGModify
MEditing a migration group
Administrator Guide (Web Version) 299