Forum Discussion

Kurt_Knochner_5's avatar
Kurt_Knochner_5
Icon for Cirrus rankCirrus
Oct 25, 2011

iControl Event Notification: Attribute - username

Hi,

 

 

basically I want to implement my own audit system using the Event Notification System. Thus I need to know the username that changed an object. However, I'm having a problem with Event Notifications. The username attribute (who initiated a change) is allways "Unknown".

 

 

According to the docs, it should contain the real username.

 

 

http://devcentral.f5.com/wiki/iControl.Management__EventNotification__EventData.ashx

 

 

Does this work?

 

Is there a working sample in devcentral?

 

 

SYSTEM: LTM 6900, 10.2.0 HF2

 

 

Regards

 

Kurt Knochner
dev
devops
iControl

2 Replies

  • Joe_Pruitt's avatar
    Joe_Pruitt
    Oct 25, 2011
    I answered this in your other thread, but I'll do so here as well. The username was originally included in the API as a forward option as that info was supposed to get included at a future date in the configuration daemon. But, alas, that hasn't happened yet so for now, the username is going to be empty. Sorry about that.
  • Kurt_Knochner_5's avatar
    Kurt_Knochner_5
    Icon for Cirrus rankCirrus
    Oct 25, 2011
    Hi Joe,

     

     

    I'd prefer to talk about the user issue in this thread, as I consider the other one as "solved". So, here we go:

     

     

    Is there any way to get the name of the user who changed the config? Audit logging provides that information, so it must be available somewhere. However, the audit log is written by httpd, which obviously knows the user name. Maybe you could scan /var/log/audit within eventd (similar to alertd) and create Events for any audit log entry ;-))

     

     

    Any idea how I can solve my problem, i.e. implement my own "audit/config change" tracker that also includes the user name?

     

     

    Thanks

     

    Kurt