Article ID: 117155, created on Sep 6, 2013, last review on May 10, 2014

  • Applies to:
  • Operations Automation

Question

A task was rescheduled for a certain timeframe and you need to know who did it.

Answer

Go to the Parallels Operations Automation (POA) UI server and check /var/log/poa-ui.log for the required timeframe. Search for the rescheduleTasks string and you should find messages similar to the following:

    2013-08-15 16:07:21,140 95c37bcfd2 ssor6 DEBUG  CORBA                #4988884: Plesk.Tasks._ManagerStub.rescheduleTasks(user_id=1 (su_user_id=1)) >>> entry
    2013-08-15 16:07:21,156 95c37bcfd2 ssor6 DEBUG  CORBA                #4988884: Plesk.Tasks._ManagerStub.rescheduleTasks(user_id=1 (su_user_id=1)) <<< exit [16]

Here, you can see the user ID of whoever ran the tasks (user_id=1 (su_user_id=1)). You can check who this is in the database. In this example, it was the admin user.

From that point, scroll up in the same log until you find an entry that contains the "bw_id" of the session in which the action was performed:

    2013-08-15 16:07:21,138            ssor6 DEBUG  OUT                  WIF:servlet=/servlet/Turbine, bw_id=aafc63d26dbd22e5daf38a95c37bcfd2, path=/referer/branding-28-customer.cloud.provider.com/never_used_param/x/action/pcp.account.task_manager.ScheduledTasksListHandler/bw_id/aafc63d26dbd22e5daf38a95c37bcfd2/uai/50000.1799491/, query=null

Now you can check when this session was started by searching for the first occurrence of this bw_id:

    2013-08-15 14:40:28,615            ssor2 DEBUG  SecurityManager      Storing new session in cache:aafc63d26dbd22e5daf38a95c37bcfd2
    2013-08-15 14:40:28,615            ssor2 DEBUG  PLoginHandler        User authenticated:admin
    2013-08-15 14:40:28,615            ssor2 DEBUG  CORBA                #4978036: com.parallels.psa._AccountStub.getAccountMember(undefined) >>> entry
    2013-08-15 14:40:28,619            ssor2 DEBUG  CORBA                #4978036: com.parallels.psa._AccountStub.getAccountMember(undefined) <<< exit [4]
    2013-08-15 14:40:28,619            ssor2 DEBUG  PLoginHandler        User logged in. sid:aafc63d26dbd22e5daf38a95c37bcfd2
    2013-08-15 14:40:28,619            ssor2 DEBUG  WindowSessionFactory Create session:aafc63d26dbd22e5daf38a95c37bcfd2
    2013-08-15 14:40:28,619            ssor2 DEBUG  SessionsStorage      Add session:aafc63d26dbd22e5daf38a95c37bcfd2
    2013-08-15 14:40:28,619            ssor2 DEBUG  WindowSessionFactory Assign aafc63d26dbd22e5daf38a95c37bcfd2 to 9B533C2B760597B4C28CBBE2EF4E669Daafc63d26db322f5d1f38a95c37bcfd2
    2013-08-15 14:40:28,619            ssor2 DEBUG  OUT                  SM:set SID=aafc63d26dbd22e5daf38a95c37bcfd2

You can also go to the POA Control Panel and check from which IP the login was performed at Top > Configuration Director > Security Manager > Users > Staff Members > admin > Login History.

Another thing you can check is which tasks were actually run. You can do this by searching "poa.debug.log" on the POA Management Node for the following combination: <bw_id>.*rescheduleTasks. Then, by scrolling down from there, you will see which tasks were updated:

    Aug 15 16:07:17 dc2paralmnpd01 : DBG [1:3677:f14ffb90:2 1:3677:f14ffb90 lib]: CORBA_POAUI:aafc63d26dbd22e5daf38a95c37bcfd2 <1> IDL:Plesk/Tasks/TaskManagerPrivate:1.0::rescheduleTasks
    ...
    Aug 15 16:07:17 dc2paralmnpd01 : DBG [1:3677:f14ffb90:2 1:3660:f49e0b90 Kernel]: STMT [Con: 5782, 0xe8ecf098 txn:999897] ' UPDATE tm_tasks SET next_start =  ? , status =  ? , run_num =  ?
      WHERE task_id =  ?'($0 = '2013-08-15 16:07:17.000000', $1 = 's', $2 = 0, $3 = 892685)
    Aug 15 16:07:17 dc2paralmnpd01 : DBG [1:3677:f14ffb90:2 1:3660:f49e0b90 Kernel]: STMT [Con: 5782, 0xe8ecf098 txn:999897] ' UPDATE tm_tasks SET next_start =  ? , status =  ? , run_num =  ?
      WHERE task_id =  ?'($0 = '2013-08-15 16:07:17.000000', $1 = 's', $2 = 0, $3 = 892683)
    Aug 15 16:07:17 dc2paralmnpd01 : DBG [1:3677:f14ffb90:2 1:3660:f49e0b90 Kernel]: STMT [Con: 5782, 0xe8ecf098 txn:999897] ' UPDATE tm_tasks SET next_start =  ? , status =  ? , run_num =  ?
      WHERE task_id =  ?'($0 = '2013-08-15 16:07:17.000000', $1 = 's', $2 = 0, $3 = 892696)
    Aug 15 16:07:17 dc2paralmnpd01 : DBG [1:3677:f14ffb90:2 1:3660:f49e0b90 Kernel]: STMT [Con: 5782, 0xe8ecf098 txn:999897] ' UPDATE tm_tasks SET next_start =  ? , status =  ? , run_num =  ?
      WHERE task_id =  ?'($0 = '2013-08-15 16:07:17.000000', $1 = 's', $2 = 0, $3 = 892684)

There is a feature request with ID POA-65694 for POA to display such information in the Control Panel. Please contact your account manager regarding the status of this request.

Search Words

audit

Track deleted DL

find a user from ui logs

Audit who changed password for user

task

caea8340e2d186a540518d08602aa065 5356b422f65bdad1c3e9edca5d74a1ae e12cea1d47a3125d335d68e6d4e15e07

Email subscription for changes to this article
Save as PDF