The File channel allows the logging server to log events directly to a file in raw format or to translate those events to a human-readable log file. The default option is to translate the log files.
Raw files simply contain the event data; therefore, they are not in a human-readable format. However, because these comma-delimited files maintain a consistent field structure across events, you can import these files into spreadsheet programs like Microsoft* Excel.
NOTE: Raw log files can be translated using the letrans utility. For more information, see see "LETrans" in the Novell® Audit Administration Guide.
Translated log files, on the other hand, can be visually scanned for content; however, it is difficult to generate reports from these files because there is no consistent field structure—they contain only the event descriptions defined in the application's log schema (LSC) file.
In addition to providing different log formats, the File channel is capable of creating localized logs. If the logging applications have localized log schema files and if those files are added to their respective Application objects, the File channel can write translated log files in the language designated in the File Channel object.
The logging server can use the File channel to write the central data store or create filtered log files. For sample configurations, see the Novell Audit Administration Guide .
At startup, the File channel driver, lgdfile, loads each application's log schema. If a logging application has multiple language versions of its log schema, the File channel loads the schema for the language designated in the File Channel object.
NOTE: The log schema file catalogs the events that can be logged for a given application. It can also provide event descriptions and labels for the event fields. For more information, see Log Schema Files.
If the File and Syslog Channel objects reference the same language, the drivers independently load the log schema in their own memory. The only time the log schema is shared is between multiple instances of the same driver. For example, if you have two File channels configured to write translated log files in English, the English log schema for each application is loaded only once.
When the File channel driver creates a raw log file, it writes the event data "as is" to the data store. If the data is in raw format and the DataSize = 0, then each line in the file is written as a comma-separated list of 19 fields in the following order:
SourceIP, ClientTimestamp, ServerTimestamp, Component, ID, Severity, GroupID, Originator, OriginatorType, Target, TargetType, SubTarget, Text1, Text2, Text3, Value1, Value2, Value3, 0 (just a trailing zero)
If DataSize is not 0, then each line in the raw file is written as a comma-separated list of 20 fields. MIMEHint replaces the trailing 0 and the last field is the Data string:
SourceIP, ClientTimestamp, ServerTimestamp, Component, ID, Severity, GroupID, Originator, OriginatorType, Target, TargetType, SubTarget, Text1, Text2, Text3, Value1, Value2, Value3, MIMEHint,DataString
When it creates a translated log file, the File driver uses the Event ID to look up each event in the corresponding application's log schema and then it writes the event description to the data store. If the log schema isn't available, or if there isn't a descriptive entry for the current event, the File channel defaults to the following format:
$DC $TC,$SO,$NI,$NL,$NG,$SB,$NH,$SU,$NV,$SY,$N1,$N2,$N3,$SS,$ST,$SF\n
(Client date and time Stamp, Component, EventID, Log Level, Group ID, Originator, OriginatorType, Target, TargetType, Subtarget, Value1, Value2, Value3, Text1, Text2, Text3.) See Event Variables for an explanation of each field and format variable.
Because it uses the log schema to write translated logs, the File driver is also capable of creating localized logs. If a logging application has localized log schema files and if those files are added to the Application object, the File driver uses the log schema for the language designated in the File Channel object to write the event descriptions. For more information on localized log schema files, see Log Schema Files.
A trademark symbol (®, , etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.