The File Channel object stores the information the File driver needs to write events to the file system.
IMPORTANT: You must restart the logging server to effect any changes in Channel object configuration. For more information on restarting the logging server, refer to the Novell Nsure Audit Administration Guide.
The following provides a description of each Channel object attribute:
Configuration |
|
|
|
Log File Location |
The path to the log file. The default log paths for each operating system are as follows:
IMPORTANT: All file data stores are named log. Therefore, if you have multiple File Channel objects, you must point them to different paths.
|
|
Purge log files after _____ seconds |
The log files life span. The logging server deletes all log files older than the designated time period.
|
|
Flush log files after _____ seconds |
Flush the log cache to the log file after the specified number of seconds.
|
|
Roll when log file reaches _____ bytes |
The log files maximum file size. When a log file reaches the designated file size, lgdfile.* renames the file and creates a new log file. The archive filename is a combination of the current date and a hexadecimal sequence number (l/yy/mm/dd.###). For example, the first log file archived on July 10, 2003 would be named l030710.001. Subsequent log files archived on the same day would be named l030710.002, l030710.003, etc.
|
Log Format |
The File channel driver can log events in either translated or raw format. Select either Translated or Raw to set the logging mode for the current Channel object.
|
|
|
Translated |
In Translated mode, the File channel driver uses the EventID to look up each event in the applications log schema and then writes the event description to the data store. If the log schema isnt available, or if there isnt a descriptive entry for the current event, the File channel defaults to the following format: $DC $TC,$SO,$NI,$NL,$NG,$N1,$N2,$SS,$ST\n (Client Date and Time Stamp, Component, Event ID, Log Level, Group ID, Value1, Value2, Text1, Text2) For an explanation of these variables, see Event Variables. NOTE: Log Schema files (*.lsc) catalog the events that may be logged for a given application. They may also provide event descriptions and labels for the event fields. For more information, see Log Schema Files. While a translated log file may be visually scanned for content, no queries can be generated from this file because there is no consistent field structure; it only contains the event descriptions.
|
|
Raw |
In Raw mode, the File channel driver simply writes the events as is to the data store. The raw log file is not in a human-readable format; however, queries may be generated from this file using the text-based query generator utility, LETrans. NOTE: For more information on LETrans, see LETrans in the Novell Nsure Audit Administration Guide.
|
|
Translated Language |
The language in which events are written to file. IMPORTANT: This option is only valid for Translated log files. If logging applications have localized Log Schema files and if those files are added to their respective Application object, the File channel can write Translated log files in the selected language. If there isnt a log schema for the selected language, the channel defaults to English. NOTE: You can create parallel logs in multiple languages by defining multiple File Channel objects with different languages and having a single notification filter pass all events to those channels. For a sample configuration, refer to the Novell Nsure Audit Administration Guide.
|
Status |
By default, all Channel objects are enabled. This means that the logging server loads the Channel objects configuration in memory at startup. If the Channel object is disabled, the logging server does not load that objects configuration at startup. IMPORTANT: The Channel object must be located in a supported Channel container for the logging server to find it. See Creating and Configuring Channels for more information. |
For more information on the File channel, see File Channel.
For general information on configuring Channel objects, see Creating and Configuring Channel Objects.
For more information on using Nsure Audit, see Nsure Audit Help.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.