Help banner

File Channel

The File channel allows the logging server to write events directly to a comma-delimited file or to translate those events to a human-readable log file.

The comma-delimited files simply contain the raw event data; therefore, they are not in a human-readable format. However, queries may be generated from these files using the text-based query generator utility, LETrans.

NOTE: For more information on LETrans, see “LETrans” in the Novell Nsure Audit Administration Guide.

Translated log files, on the other hand, may be visually scanned for content; however, it is difficult generate queries from these files because there is no consistent field structure—they only contain the event descriptions.

In addition to providing different log formats, the File channel is capable of creating localized logs. If the logging applications have localized log schema files and if those files are added to their respective Application objects, the File channel can write Translated log files in the language designated in the File Channel object.

NOTE: The Log Schema catalogs the events that may be logged for a given application. It may also provide event descriptions and labels for the event fields. For more information, see Log Schema Files.

The logging server can use the File channel to write the central data store or create filtered log files. For sample configurations, see the Novell Nsure Audit Administration Guide.

File Channel Driver

At startup, the File channel driver, lgdfile.*, loads each application’s log schema. If a logging application has multiple language versions of its log schema, the File channel loads the schema for the language designated in the File Channel object.

NOTE: Nsure Audit stores the log schema files as attributes in their respective Application object. For further information, see Log Schema Files.

NOTE: If the File and Syslog Channel objects reference the same language, the drivers independently load the log schema in their own memory. The only time the log schema is shared is between multiple instances of the same driver. For example, if you have two File channels configured to write Translated log files in English, the English log schema for each application is only loaded once.

When the File channel driver creates a raw log file, it simply writes the events “as is” to the data store.

When it creates a translated log file, the File driver uses the EventID to look up each event in the corresponding application’s log schema, and it writes the event description to the data store. If the log schema isn’t available or if there isn’t a descriptive entry for the current event, the File channel defaults to the following format:

$DC $TC,$SO,$NI,$NL,$NG,$N1,$N2,$SS,$ST\n

(Client Date and Time Stamp, Component, Event ID, Log Level, Group ID, Value1, Value2, Text1, Text2) For an explanation of these variables, see Event Variables.

Because it uses the log schema to write translated logs, the File driver is also capable of creating localized logs. If a logging application has localized log schema files and if those files are added to their respective Application object, the File driver uses the log schema for the language designated in the File Channel object to write the event descriptions. For more information on the File channel’s language attribute, see File Channel Configuration. For information on localized log schema files, see Log Schema Files.

For information on configuring a File Channel object, see File Channel Configuration.

For more information on using Nsure Audit, see Nsure Audit Help.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.