Help banner

Creating and Configuring Notification Objects

NOTE: By default, your main logging channel receives all events. Notifications are required only if you want to send specific events to a channel other than your main logging channel. Do not send notifications to your main logging channel, because this results in duplicate logged events.

Novell® Audit provides two kinds of event notification:

Filtered notification tells you when a specific event has occurred; heartbeat notification tells you when an event has not occurred.

As the name implies, Notification Filters filter specific events from the stream of incoming events. The filtered events are then routed to one or more channel drivers where they can be logged to a database, routed to a Java* application or SNMP management system, or broadcast to an administrator via SMTP. In some cases, filtered events can be directed to the CVR channel to trigger a reset policy.

Heartbeat objects monitor the stream of incoming events for the occurrence of a specific Event ID. If the event does not occur within the designated interval, the logging server generates a heartbeat event (Event ID 0001001). This event is automatically logged to the central data store; however, if you want to receive notification that a specific event has not occurred, you must create a Notification Filter for the corresponding heartbeat event.

Both filtered and heartbeat notifications are configured in eDirectory™ using Notification Filter and Heartbeat objects. These objects define event criteria and designate which Channel objects should be used to provide event notification.

Notification objects can only be created within Notification containers. Notification containers provide a reference point through which the logging server can locate Notification objects. At startup, the logging server scans its list of supported Notification containers and loads the included Notification object configurations in memory where they can be used to filter events and provide event notification.

The Notification container under Logging Services is automatically created during installation; however, Notification containers can be created anywhere in the tree.

IMPORTANT: The logging server only loads the Notification object configurations that are located in supported Notification containers. Therefore, if you create a new Notification container or Notification object, you must ensure the Notification container is included in the logging server's Notification container list.

 

Creating Notification Objects

IMPORTANT: The logging server loads the Notification object configurations from its supported Notification containers at startup. Therefore, if you create a Notification object, you must restart the logging server for the change to take effect. For information on restarting the logging server, refer to the Novell Audit Administration Guide.

To define event criteria, you must be familiar with event structure. All events have a fixed set of fields. Because the field structure is consistent across all events, the logging server can use these fields to filter events. When you define a Notification object, you specify a value for a given event field. To narrow the results, you can define values for multiple event fields. Using standard And, Or, Not, and End operators, you can define up to 15 event conditions. For more information on the event fields, see Event Structure.

After you define the event criteria, you must select a notification channel. Notification channels are simply the Channel objects the logging server uses to provide event notification. For example, if you want to e-mail events to your mailbox, you must select an SMTP Channel object that is configured to relay events to your e-mail address. Similarly, if you want to log events to a MySQL* database, you must select a MySQL Channel object that is configured to write events to the correct database and table. You can define multiple notification channels for any given Notification object.

To create a new Notification object:

  1. On the Logging Server Options page, click the Notifications tab.

  2. Select the box next to the Notification container in which you want to create the Notification object.

    If the container is not listed, you can add the Notification container.

  3. Click Notification Actions, then select New.

    The New Notification menu opens.

  4. Type a name for the object in the Notification Name field.

  5. Select either Notification or Heartbeat Notification.

  6. Click OK to create the Notification object.

    The Modify Object menu for the notification opens.

  7. Configure the Filter Notification or Heartbeat Notification object attributes.

  8. When finished, click OK.

 

Configuring Notification Objects

IMPORTANT: The logging server loads the Notification object configurations from its supported Notification containers at startup. Therefore, if you modify a Notification object, you must restart the logging server for the change to take effect. For information on restarting the logging server, refer to the Novell Audit Administration Guide.

To configure a Notification object:

  1. On the Logging Server Options page, click the Notifications tab.

  2. Select the box next to the Notification object you want to configure.

    If the Notification object isn't visible, click the plus icon next to the object's Notification container to expand the object list.

  3. Click Notification Actions, then select Edit.

    The Modify Object menu for the notification opens.

  4. Configure the Filter Notification or Heartbeat Notification object attributes.

  5. When finished, click OK.

Related Topics

Adding and Removing Notification Containers

Configuring the Secure Logging Server

Novell Audit Help

A trademark symbol (®, ™, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.

Close