Highlighted
Absent Member.
Absent Member.
332 views

How to find which user deleted the entries in the Active list in ESM

Hi,

there is a scenario where entries in Active list erased. I would like to know who/how entries were deleted in Active List in ESM

Can some one help me on this is there a way to find the details about how or who has erased the Active list entries.

Thanks in advance!!

Labels (1)
0 Likes
2 Replies

Hello Akshay,

Look for the following events:

Device Event Class ID: activelist:102

Name: ActiveList entry deleted

This are internal events generated by the Manager Internal Agent and they are triggered when an active list entry is deleted.

Namely, in those events you will find additional information such as:

File Name: <name of your active list>

File Path: <path to your active list>

Target User Name and Target User ID: <information about the user who deleted the entry, if it was a user that did it>

Otherwise check the events and see what other pieces of information are valuable to your scenario.

All the best,

Stefan

0 Likes
Highlighted
Absent Member.
Absent Member.

Hi

How to retrieve the clear entries from any active list.

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.