Appendix K.3 Action log output format

Information related to audit events is output to the Performance Management action log. One action log information file is output for one host (physical host and logical host). The action log file is output to either of the following hosts:

The following describes the format of the action log, the output destination, and the items that are output.

Organization of this subsection
(1) Output format
(2) Output destination
(3) Output items
(4) Output example

(1) Output format

CALFHM x.x,output-item-1=value-1,output-item-2=value-2,...,output-item-n=value-n

(2) Output destination

On physical hosts
  • In Windows
    installation-folder\auditlog\
  • In UNIX
    /opt/jp1pc/auditlog/
On logical hosts
  • In Windows
    environment-folder\jp1pc\auditlog\
  • In UNIX
    environment-directory/jp1pc/auditlog/

The action log output destination can be changed in the jpccomm.ini file. For details about how to specify the jpccomm.ini file, see K.4 Settings for outputting action logs.

(3) Output items

There are two types of output items:

(a) Common output items

The following table lists and describes the common output items and their values. This table also includes the items and information output by PFM - Manager.

Table K-2 Common output items in action logs

No.Output itemValueExplanation
Item nameOutput attribute name
1Common specification identifier--CALFHMIndicates the action log format.
2Common specification revision number--x.xRevision number for managing action logs
3Serial numberseqnumserial-numberSerial number of the action log record
4Message IDmsgidKAVExxxxx-xMessage ID of the product
5Date and timedateYYYY-MM-DDThh:mm:ss.sssTZD#Date, time, and time zone indication identifying when the action log was output
6Program nameprogidJP1PFMName of the program for which the event occurred
7Component namecompidservice-IDName of the component for which the event occurred
8Process IDpidprocess-IDProcess ID of the process for which the event occurred
9Locationocp:host
  • host-name
  • IP-address
Location where the event occurred
10Event typectgry
  • StartStop
  • Authentication
  • ConfigurationAccess
  • ExternalService
  • AnomalyEvent
  • ManagementAction
Category name used to classify the event output to the action log
11Event resultresult
  • Success
  • Failure
  • Occurrence
Result of the event
12Subject identification informationsubj:pidprocess-IDOne of the following:
  • Process ID of a process running as a user operation
  • Process ID of the process that caused the event
  • Name of the user who caused the event
  • Identification information in a one-to-one correspondence with the user
subj:uidaccount-identifier (PFM user/JP1 user)
subj:euideffective-user-ID (OS user)
Legend:
--: None
#
T is a separator between the date and the time.
TZD is the time zone specifier. One of the following values is output.
+hh:mm: The time zone is hh:mm ahead of UTC.
-hh:mm: The time zone is hh:mm behind UTC.
z: The time zone is same as UTC.
(b) Fixed output items

The following table lists and describes the fixed output items and their values. This table also includes the items and information output by PFM - Manager.

Table K-3 Fixed output items in action logs

No.Output itemValueExplanation
Item nameOutput attribute name
1Object informationobj
  • PFM - RM for Oracle-service-ID
  • added-deleted-or-updated-user-name (PFM user)
Intended object for the operation
obj:tablealarm-table-name
obj:alarmalarm-name
2Action informationop
  • Start
  • Stop
  • Add
  • Update
  • Delete
  • Change Password
  • Activate
  • Inactivate
  • Bind
  • Unbind
Information about the action that caused the event
3Permissions informationauth
  • Administrator
    Management
  • General user
    Ordinary
  • Windows
    Administrator
  • UNIX
    SuperUser
Permissions information of the user who executed the command or service
auth:mode
  • PFM authentication mode
    pfm
  • JP1 authentication mode
    jp1
  • OS user
    os
Authentication mode of the user who executed the command or service
4Output sourceoutp:hostPFM - Manager-host-nameHost that output the action log
5Instruction sourcesubjp:host
  • login-host-name
  • execution-host-name (only when the jpctool alarm command is executed)
Host that issued the instruction for the operation
6Free descriptionmsgmessageMessage that is output when an alarm occurs or when an automated action is executed

Whether the fixed output items are output and what they contain differ depending on when the action log is output. The following describes the message ID and output information for each case.

A PFM service is started or stopped (StartStop)

When a PFM service is started or stopped (StartStop), the message ID and action information are output. The following table shows the message ID and action information value that is output.

Table K-4 Message ID and action information value output when a PFM service is started or stopped (StartStop)

Item nameAttribute nameValue
Message IDmsgidStarted: KAVE03000-I
Stopped: KAVE03001-I
Action informationopStarted: Start
Stopped: Stop
Stand-alone mode is started or terminated (StartStop)

When stand-alone mode is started or stopped (StartStop), the message ID is output. The following table shows the message ID value that is output.

Table K-5 Message ID value output when stand-alone mode is started or stopped (StartStop)

Item nameAttribute nameValue
Message IDmsgidStand-alone mode has started: KAVE03002-I
Stand-alone mode has terminated: KAVE03003-I
Note:
  1. No fixed output items are output.
  2. When PFM - RM for Oracle is started, PFM - RM services connect to the PFM - Manager host, register node information, and obtain the latest alarm definition information. If a connection with the PFM - Manager host cannot be established, a PFM - RM service starts in stand-alone mode. In this mode, only part of the service's functionality, such as the collection of operating information, is enabled. At the same time, KAVE03002-I is output to indicate that the service has started in stand-alone mode. When the services are able to successfully register node information or obtain definition information, PFM - RM for Oracle leaves stand-alone mode and KAVE03003-I is output. In this way, the action log enables you to understand that PFM - RM for Oracle was running in an imperfect condition for the period from the output of KAVE03002-I to the output of KAVE03003-I.
The status of the connection with PFM - Manager changes (ExternalService)

When the status of the connection with PFM - Manager changes (ExternalService), the message ID is output. The following table shows the t message ID value that is output.

Table K-6 Message ID value output when the status of the connection with PFM - Manager changes (ExternalService)

Item nameAttribute nameValue
Message IDmsgidSending of an event to PFM - Manager failed (queuing was started): KAVE03300-I
An event was resent to PFM - Manager: KAVE03301-I
Note:
  1. No fixed output items are output.
  2. When sending of an event to PFM - Manager fails, Remote Monitor Store service starts queuing events. The maximum capacity of the queue is 3 events. KAVE03300-I is output when sending of an event to PFM - Manager fails and queuing starts. After the connection with PFM - Manager restores and the queued events are resent, KAVE03301-I is output. From this sequence of the log, you can judge that the period when an event-sending to PFM - Manager is not real time is specifiable.
  3. Remote Monitor Collector service normally sends events to PFM - Manager through Remote Monitor Store service. Remote Monitor Collector service directly sends events to PFM - Manager only when Remote Monitor Store Service stops for any reason. When Remote Monitor Collector Service fails to send events directly to PFM - Manager, KAVE03300-I is output. In this case, KAVE03301-I is no output because the queuing does not start. From this sequence of the log, you can judge that there are events that are not sent to PFM - Manager.
An automated action is executed (ManagementAction)

When an automated action is executed (ManagementAction), the message ID and a free description are output. The following table shows the message ID and free description value that are output.

Table K-7 Message ID and free description value output when an automated action is executed (ManagementAction)

Item nameAttribute nameValue
Message IDmsgidThe command execution process was created successfully: KAVE03500-I.
An attempt to create a command execution process failed: KAVE03501-W.
E-mail was send successfully: KAVE03502-I.
Sending of e-mail failed: KAVE03503-W
Free descriptionmsgCommand execution: cmd=executed-command-line.
E-mail sending: mailto=destination-email-address.
Note:
KAVE03500-I is output when the command execution process is successfully created. After KAVE03500-I is output, whether the command is successfully executed or not and the execution result are not output to the action log.

(4) Output example

The following is an example of action log output.

CALFHM 1.0, seqnum=1, msgid=KAVE03000-I, date=2007-01-18T22:46:49.682+09:00,
progid=JP1PFM, compid=1A1host01, pid=2076,
ocp:host=host01, ctgry=StartStop, result=Occurrence,
subj:pid=2076,op=Start,