Help banner

Modify Object - File Channel

The File Channel object stores the information the File driver needs to write events to the file system.

IMPORTANT: You must restart the logging server to effect any changes in Channel object configuration. For more information on restarting the logging server, refer to the Novell® Audit Administration Guide.

The following provides a description of each Channel object attribute:

Item

Description

Configuration

 

 

Log File Location

The path to the log file.

The default Log File directories are as follows:

  • sys:/etc/logdir (NetWare®)

  • /program files/novell/nsure audit/logs (Windows*)

  • /var/opt/novell/naudit/logs (Linux*)

  • /opt/NOVLnaudit/logs (Solaris*)

IMPORTANT: By default, all File datastores are named AUDITLOG. Therefore, if you have multiple File Channel objects, you must either give each log file a different filename or point them to different paths.

 

 

Log File Name

The name of the file to which the logging server writes events. The default filename is AUDITLOG.

 

 

Purge log files after _____ seconds

The life span of the log files. The logging server deletes all log files older than the designated time period.

 

 

Flush log files after _____ seconds

The interval at which the File channel flushes the events in memory to the log file on disk.

NOTE: On NetWare, the File channel writes events to memory and intermittently flushes the events to disk. To manually flush the File channel buffers, enter naudit file flush at the server console.

 

 

Roll when log file reaches _____ bytes

The log file's maximum file size. When a log file reaches the designated file size, lgdfile.* renames the file and creates a new log file.

The archive filename is a combination of the current date and a hexadecimal sequence number (l/yy/mm/dd.###). For example, the first log file archived on July 10, 2003 would be named l030710.001. Subsequent log files archived on the same day would be named l030710.002, l030710.003, etc.

 

Log Format

The File channel can log events in either translated or raw format. Select either Translated or Raw to set the logging mode for the current Channel object.

 

 

Translated

In Translated mode, the File channel uses the EventID to look up each event in the application's log schema and then writes the event description to the data store.

If the log schema isn't available, or if there isn't a descriptive entry for the current event, the File channel defaults to the following format:

$DC $TC,$SO,$NI,$NL,$NG,$N1,$N2,$SS,$ST\n

(Client Date and Time Stamp, Component, Event ID, Log Level, Group ID, Value1, Value2, Text1, Text2) For an explanation of these variables, see Event Variables.

NOTE: Log schema files (*.lsc) catalog the events that can be logged for a given application. They can also provide event descriptions and labels for the event fields. For more information, see Log Schema Files.

While a translated log file can be visually scanned for content, no queries can be generated from this file because there is no consistent field structure; it only contains the event descriptions.

 

 

Raw

In Raw mode, the File channel simply writes the events as-is to the data store.

The raw log file is not in a human-readable format; however, queries may be generated from this file using the text-based query generator utility, LETrans.

NOTE: For more information on LETrans, see "LETrans" in the Novell Audit Administration Guide.

 

 

Translated Language

The language in which events are written to file.

IMPORTANT: This option is only valid for Translated log files.

If logging applications have localized log schema files and if those files are added to their respective Application object, the File channel can write Translated log files in the selected language. If there isn't a log schema for the selected language, the channel defaults to English.

You can create parallel logs in multiple languages by defining multiple File Channel objects with different languages and having a single notification filter pass events to all those channels.

 

Status

By default, all Channel objects are enabled. This means that the logging server loads the Channel object's configuration in memory at startup.

IMPORTANT: The Channel object must be located in a supported Channel container for the logging server to find it. See Creating and Configuring Channels for more information.

If you select the Disabled option, you must restart the Secure Logging Server for the setting to become effective. Thereafter, the logging server cannot load the object's configuration until you select Enabled.

 

 

Related Topics

File Channel

Creating and Configuring Channel Objects

Novell Audit Help

A trademark symbol (®, ™, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.

Close