Event Details
User Activity->Privilege Use->Privilege Sessions (TPAM)->Password: Retrieve for Session
Password: Retrieve for Session
 Sample: 
Feb 12 18:59:55 10.30.44.209 PAR[5476]: UserName: tpamsm Operation: Retrieve for Session ObjectType: Password Target: dimalinux/yk65 Role: Requestor Failed? 0
Log Type: Generic Syslog
 Uniquely Identified By:
OS Type: Any
Filtering RegExp: ^(.{15}) ([-[:alnum:]_.]+) ([^():]+)(\([^[]+\)){0,1}(\[[0-9]+\]){0,1}: (UserName: (.*) Operation: (.*) ObjectType: (.*) Target: (.*) Role: (.*[^])[]* Failed\? (.*))
Field Matching
FieldDescriptionStored inSample Value
When At what date and time a user activity originated in the system. DateTime Feb 12 18:59:55
Who Account or user name under which the activity occured. UserName tpamsm
What The type of activity occurred (e.g. Logon, Password Changed, etc.) "Password was retrieved for Session." Password was retrieved for Session.
Where The name of the workstation/server where the activity was logged. Computer 10.30.44.209
Where From The name of the workstation/server where the activity was initiated from. -
Severity Specify the seriousness of the event. -
WhoDomain -
WhereDomain -
UserName TPAM user account initiating event. - tpamsm
Operation Type of action - Retrieve for Session
ObjectType Type of the object on which action is taken. - Password
Target Name of the object on which action is taken. - dimalinux/yksm
Role Permission type - Requestor
Failed Result of execution (0 - true, 1 - false) - 0
Comments
You must be logged in to comment