IBM BS029ML - WebSphere Portal Server Self Help Manual page 118

The audit log entries would look like the ones shown in Example 4-2.
Example 4-2 Audit log examples
[08/08/07 19:07:37:703 EDT] I Audit
0000011447bbb24a000000020000069d84c32de6073235ad5834768ac19ebc8ad33e21210000011447
bbb24a000000020000069d84c32de6073235ad5834768ac19ebc8ad33e212100000001 EJPSN0014I:
User [uid=wpsadmin,ou=people,ou=dept,o=acme.com] has created a Resource for
ObjectID = 6_AoJ234SKG10GA5C0252FNRKA0000 and Name = Audittest
[08/08/07 19:08:40:953 EDT] I Audit <no transaction> EJPSN0004I: User
[uid=wpsadmin,ou=people,ou=dept,o=acme.com] has created a User with ID =
uid=audittest,ou=people,ou=dept,o=acme.com, Name = audittest and ObjectID =
9eAe1JC03JH6GPO0JMGC13DEJM46GHC4MM47KHC6JMCC4JCCMG16M9O23OCCM1
You can see that the time stamp, the user ID, the resource name, and ObjectID are all clearly
logged in the file. These audit logs should be saved for the lifetime of the portal system. Using
a custom script, you may be able to generate a change log from the audit log files.
Understand and recreate the problem
When a problem is reported or encountered, information about the problem should be
collected as soon as possible while the memory is fresh. A clear description of the problem
and how to recreate it should be documented.
The following list of questions may help you better understand the situation and collect as
much information as possible:
What is the problem? How can you describe the problem?
Are there any error messages? Is a screen capture available?
When did it happen? Under what conditions was the problem observed? Can this problem
be easily recreated?
Have there been any changes done on the system components? If yes, what kind of
changes have been made in the past two weeks before the problem started?
Does this problem affect all users, including the portal administrator user? If only some
users are affected, what are the major differences about the affected users and those who
are not affected?
Are there any special conditions that were met when the problem started? How can you
tell whether your recreation of the problem is the same?
We should try to simplify the situation and eliminate the factors to isolate the problem. If you
are not sure whether some components or users have anything to do with the problem, for
example, try to remove them from the situation and see whether you can still recreate the
problem.
If the problem can be recreated, clearly document the steps of recreation, the conditions
under which the problem had happened, and the user or group information that can be used
to recreate it.
When recreating a problem, the time should be as accurate as possible. If a specific user is
required, get the user full DN and an LDIF output of the attributes and the groups the user
belongs to.
Save all the relevant documents for analyzing security related problems, and collect WMM
configuration files in <wp_root>/wmm directory, wpconfig.properties, security.xml, and log
104
IBM WebSphere Portal V6 Self Help Guide