PowerProtect: Audit log missing entries like 1 asset assigned unassigned to Policy by user selection
Summary: PowerProtect Data Manager Audit log is missing entries. For example, "1 assets assigned or unassigned to 'Policy' by user selection." The other entries like "Protection Policy 'Policy' is disabled or enabled." are working fine. ...
Symptoms
From PowerProtect Data Manager UI -> Administration -> Audit Logs, it is supposed to report entries like "1 assets assigned or unassigned to 'Policy' by user selection."
However, after customer assigned or unassigned the assets from the policy, the messages like "1 assets assigned or unassigned to 'Policy' by user selection" was never shown up in the audit logs.
The other entries like "Protection Policy 'Policy' is disabled or enabled." can be viewed in the audit logs.
Cause
Messages like "1 assets assigned or unassigned to 'Policy' by user selection" was sent by PowerProtect Data Manager CBS service (Common Business Service).
From the PowerProtect Data Manager server that is working fine, we could see in the /var/log/brs/cbs/cbs.log, when asset-assignments was called, CBS service forks ForkJoinPool.commonPool-worker thread to print audit log.
2024-06-17T04:03:46.586Z INFO [] [https-jsse-nio-8445-exec-9] [][][][TRACE_ID:a59bb34d999eff0d][] [c.e.b.c.f.RestLogFilter.doFilter(43)] - Enter RESTful Msg - Method: POST , Path: https://localhost:8443/api/v2/protection-policies/9e532ce9-62d9-4d56-b1bf-8b3c5aa6ecc8/asset-assignments ...... 2024-06-17T04:03:46.966Z INFO [] [ForkJoinPool.commonPool-worker-102525] [][][][][] [c.e.d.e.c.s.a.DefaultAuditLogResourceModifierAndDecorator.getMessageWithArgs(212)] - messageTemplate: '<num> asset(s) assigned to <plcName> by <triggerSource>.', messageArgs: [1, 'Test', user selection], messageArgs size: 3 2024-06-17T04:03:46.985Z INFO [] [ForkJoinPool.commonPool-worker-102525] [][AUDIT][][][] [c.e.d.e.c.s.a.DefaultAuditLogResourceModifierAndDecorator.printAuditLog(251)] - Source: null; Audit Type: PROTECTION_POLICY; Details: 1 asset(s) assigned to 'Policy' by user selection.; Changed By: admin; Changed At: Jun 17, 2024 14:03:46 PM; Object Changed: 'Test'; Previous Value: ; New Values: client; Note: null
However, on PowerProtect Data Manager that is not working, when asset-assignments was called, thread ForkJoinPool.commonPool-worker was never invoked for some reason.
Resolution
1. When PowerProtect Data Manager is idle, log in to the PowerProtect Data Manager appliance using SSH, switch to the root user.
2. Run below command to restart the CBS and Logmgr services
cbs restart logmgr restart
3. Wait several minutes for the service to be restarted completely, reassign the assets, and see if the audit log reports that.