The details of which user logged in from which host are stored in DOMAIN_SERVER_user.activity*.EVT logs, located at /opt/nastel/AutoPilotM6/logs. The same event log also storesall the operations performed by each user.
See the sample screenshot below.
In on the screenshot, the Account field shows the username that was used to log in. The Message field indicates which operation was performed and by whom. For example, the third row shows that the policy "Citi_Tivoli_Log_Testing_WMQ_Channels" was removed. It also displays some IP addresses, which represent the machines from which users logged in.
To access this log via EM, right click DOMAIN_SERVER and select View Events. Now click on DOMAIN_SERVER Logs and select user.activity. See screenshot below with numbering.
Lastly, if the event log file sizes are too small, refer to the Event Logs section in the Resource Centre article.
If hostnames are not available, we will have IP addresses instead. We can use the nslookup command on the IP address to retrieve the corresponding hostname.