IBM BS029ML Self Help Guide - Page 118

The audit log entries would look like the ones shown in Example 4-2. Example 4-2 Audit log examples [08/08/07 19:07:37:703 EDT] I Audit 0000011447bbb24a000000020000069d84c32de6073235ad5834768ac19ebc8ad33e21210000011447 bbb24a000000020000069d84c32de6073235ad5834768ac19ebc8ad33e212100000001 EJPSN0014I: User [uid=wpsadmin,ou=people,ou=dept,o=acme.com] has created a Resource for ObjectID = 6_AoJ234SKG10GA5C0252FNRKA0000 and Name = Audittest [08/08/07 19:08:40:953 EDT] I Audit EJPSN0004I: User [uid=wpsadmin,ou=people,ou=dept,o=acme.com] has created a User with ID = uid=audittest,ou=people,ou=dept,o=acme.com, Name = audittest and ObjectID = 9eAe1JC03JH6GPO0JMGC13DEJM46GHC4MM47KHC6JMCC4JCCMG16M9O23OCCM1 You can see that the time stamp, the user ID, the resource name, and ObjectID are all clearly logged in the file. These audit logs should be saved for the lifetime of the portal system. Using a custom script, you may be able to generate a change log from the audit log files. Understand and recreate the problem When a problem is reported or encountered, information about the problem should be collected as soon as possible while the memory is fresh. A clear description of the problem and how to recreate it should be documented. The following list of questions may help you better understand the situation and collect as much information as possible: What is the problem? How can you describe the problem? Are there any error messages? Is a screen capture available? When did it happen? Under what conditions was the problem observed? Can this problem be easily recreated? Have there been any changes done on the system components? If yes, what kind of changes have been made in the past two weeks before the problem started? Does this problem affect all users, including the portal administrator user? If only some users are affected, what are the major differences about the affected users and those who are not affected? Are there any special conditions that were met when the problem started? How can you tell whether your recreation of the problem is the same? We should try to simplify the situation and eliminate the factors to isolate the problem. If you are not sure whether some components or users have anything to do with the problem, for example, try to remove them from the situation and see whether you can still recreate the problem. If the problem can be recreated, clearly document the steps of recreation, the conditions under which the problem had happened, and the user or group information that can be used to recreate it. When recreating a problem, the time should be as accurate as possible. If a specific user is required, get the user full DN and an LDIF output of the attributes and the groups the user belongs to. Save all the relevant documents for analyzing security related problems, and collect WMM configuration files in /wmm directory, wpconfig.properties, security.xml, and log 104 IBM WebSphere Portal V6 Self Help Guide