Help banner

Modify Object - File Channel

The File Channel object stores the information the File driver needs to write events to the file system.

IMPORTANT: You must restart the logging server to effect any changes in Channel object configuration. For more information on restarting the logging server, refer to the Novell Nsure Audit Administration Guide.

The following provides a description of each Channel object attribute:

Configuration

 

 

Log File Location

The path to the log file.

The default log paths for each operating system are as follows:

  • sys:/etc/logdir (NetWare)

  • /Program Files/Novell/Nsure Audit/Logs (Windows)
  • /usr/naudit/logs (Linux)
  • /op/NOVLnaudit/logs (Solaris)

IMPORTANT: All file data stores are named “log.” Therefore, if you have multiple File Channel objects, you must point them to different paths.

 

 

Purge log files after _____ seconds

The log files’ life span. The logging server deletes all log files older than the designated time period.

 

 

Flush log files after _____ seconds

Flush the log cache to the log file after the specified number of seconds.

 

 

Roll when log file reaches _____ bytes

The log file’s maximum file size. When a log file reaches the designated file size, lgdfile.* renames the file and creates a new log file.

The archive filename is a combination of the current date and a hexadecimal sequence number (l/yy/mm/dd.###). For example, the first log file archived on July 10, 2003 would be named l030710.001. Subsequent log files archived on the same day would be named l030710.002, l030710.003, etc.

 

Log Format

The File channel driver can log events in either translated or raw format. Select either Translated or Raw to set the logging mode for the current Channel object.

 

 

Translated

In Translated mode, the File channel driver uses the EventID to look up each event in the application’s log schema and then writes the event description to the data store.

If the log schema isn’t available, or if there isn’t a descriptive entry for the current event, the File channel defaults to the following format:

$DC $TC,$SO,$NI,$NL,$NG,$N1,$N2,$SS,$ST\n

(Client Date and Time Stamp, Component, Event ID, Log Level, Group ID, Value1, Value2, Text1, Text2) For an explanation of these variables, see Event Variables.

NOTE: Log Schema files (*.lsc) catalog the events that may be logged for a given application. They may also provide event descriptions and labels for the event fields. For more information, see Log Schema Files.

While a translated log file may be visually scanned for content, no queries can be generated from this file because there is no consistent field structure; it only contains the event descriptions.

 

 

Raw

In Raw mode, the File channel driver simply writes the events “as is” to the data store.

The raw log file is not in a human-readable format; however, queries may be generated from this file using the text-based query generator utility, LETrans.

NOTE: For more information on LETrans, see “LETrans” in the Novell Nsure Audit Administration Guide.

 

 

Translated Language

The language in which events are written to file.

IMPORTANT: This option is only valid for Translated log files.

If logging applications have localized Log Schema files and if those files are added to their respective Application object, the File channel can write Translated log files in the selected language. If there isn’t a log schema for the selected language, the channel defaults to English.

NOTE: You can create parallel logs in multiple languages by defining multiple File Channel objects with different languages and having a single notification filter pass all events to those channels. For a sample configuration, refer to the Novell Nsure Audit Administration Guide.

 

Status

By default, all Channel objects are enabled. This means that the logging server loads the Channel object’s configuration in memory at startup.

If the Channel object is disabled, the logging server does not load that object’s configuration at startup.

IMPORTANT: The Channel object must be located in a supported Channel container for the logging server to find it. See Creating and Configuring Channels for more information.

For more information on the File channel, see File Channel.

For general information on configuring Channel objects, see Creating and Configuring Channel Objects.

For more information on using Nsure Audit, see Nsure Audit Help.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.