User Action Logs

It is a service that performs the user action logs related operations like get user filter type, get user log generated file, etc.

API Calls
Get

/v5/ual/filters

Get

/v5/ual/{starttime}/{endtime}/{filtertype}/{encoding}

Get Filters for User Action Logs

Description Fetches the filters for User Action logs from Arista Server or Arista Cloud Services.
Who Can Execute? Superuser, Administrator, Operator, and Viewer.
Syntax
GET <Base_URL>/ual/filters
Sample code
GET https://training.mojonetworks.com/new/webservice/v5/ual/filters
Request Body This API call does not require any request body parameters.
Response Body If the API call is successful, the HTTP response status is 200. The response body contains the filter types for the User Action logs. The response is in the application/json format.

The table below describes the logs related to each filter type:

Filter Type Description
Access Logs related to accessing the system. For example, log-in, log-out, LDAP authentication has been enabled, login failed, etc.
Devices Logs related to changes to devices. For example, some property of the device is changed, a sensor added, template changed, etc.
Events Logs related to changes to events in the system. For example, marked an event as read, changed its location, etc.
Global Settings Logs related to any changes to global settings of the system. For example, a WLC controller added, a vendor added, changed syslog/arcsight settings, etc.
Local Settings Logs related to changes made to local policies. For example, enabled intrusion prevention at a location changed client classification at a location, added a template at a location, etc.
Location Tree Logs related to changes made to the location tree. For example, adding a location, edited a location, deleted a location, etc.
Reports Logs related to changes to report functions. For example, added a report schedule, added a report, changed report look and feel settings, etc.
Start/Stop Functions Logs related to start and stop of system functions. For example server shutdown, server reset to factory defaults, SSH access disabled, etc.
System Logs related to changes in the system settings. For example, server upgraded, server ID changed, routing table edited, etc.
Others Logs which are not grouped in any of the above categories. Currently includes logs related to WLC, Aruba, HP log level change, and mapper file for WLC.

Get User Action Logs of a Filter Type for a Location

Description Fetches the User Action logs for a specified filter type and location from Arista Server or Arista Cloud Services.
Who Can Execute? Superuser, Administrator, Operator, and Viewer.
Syntax
GET <Base_URL>/ual/{starttime}/{endtime}/{filtertype}/{encoding}
  • starttime

    The time in milliseconds indicating the starting date from which the user action logs must be fetched. For example, 1384194600000. Ensure that the start date is prior to the end date.

  • endtime

    The time is milliseconds indicating the date until which the user action logs must be fetched. For example, 1386786600000.

  • filtertype

    An integer value indicating the filter type to be used for fetching the user action logs, For example, 1. The filter types can be fetched using the Get Filter Types for User Action Logs API.

  • encoding

    The encoding type to be used. For example, UTF-8.
Sample code
GET https://training.mojonetworks.com/new/webservice/v5/ual/1000000/2000000/1/UTF-8?sortfilter=DATE_TIME&location={“type”:”locallocationid”,”id”:1}
Request Body This API call does not require any request body parameters.
Response Body If the API call is successful, the HTTP response status is 200. The response body contains a partial URL to access the generated User Action logs.

A sample response is as follows:

webservice/sfiles?id=40da8582-f449-464b-a005-a47d102178bd

This partial URL must be appended to:

https://<Arista_Server_IP>/new/

Where <Arista_Server_IP> is the IP address or FQDN of the Arista Server. If you are using Arista Cloud Services, then use the URL provided by Arista Networks Support team instead of the server IP.

Below is the resulting URL. To access the User Action logs, execute the below call as a usual GET API call.

https://training.mojonetworks.com/new/webservice/sfiles?id=40da8582-f449-464b-a005-a47d102178bd
JSON Table

Attribute Data Type Description
filterType int The ID of the filter type.
displayName String The name of the filter type.

Sample JSON 
[{
   "filterType":1,
   "displayName":"Access"
},
{
   "filterType":2,
   "displayName":"Devices"
},
{
   "filterType":3,
   "displayName":"Events"
},
{
   "filterType":4,
   "displayName":"Global Settings"
},
{
   "filterType":5,
   "displayName":"Local Settings"
},
{
   "filterType":6,
   "displayName":"Location Tree"
},
{
   "filterType":7,
   "displayName":"Reports"
},
{
   "filterType":8,
   "displayName":"Start/Stop Functions"
},
{
   "filterType":9,
   "displayName":"System"
},
{
   "filterType":10,
   "displayName":"Others"
}]