Nsure Audit provides two kinds of event notification:
Filtered Notification
Heartbeat Notification
Filtered notification tells you when a specific event has occurred; heartbeat notification tells you when an event has not occurred.
As the name implies, Notification Filters filter specific events from the stream of incoming events. The filtered events are then routed to one or more channel drivers where they may be logged to a database, routed to a java application or SNMP management system, or broadcast to an administrator via SMTP. In some cases, filtered events may be directed to the CVR channel to trigger a reset policy.
Heartbeat objects monitor the stream of incoming events for the occurrence of a specific Event ID. If the event does not occur within the designated interval, the logging server generates a heartbeat event (Event ID 0001001). This event is automatically logged to the central data store; however, if you want to receive notification that a specific event has not occurred, you must create a Notification Filter for the corresponding heartbeat event.
Both filtered and heartbeat notifications are configured in eDirectory using Notification Filter and Heartbeat objects. These objects define event criteria and designate which Channel objects should be used to provide event notification.
Notification objects can only be created within Notification containers. Notification containers provide a reference point through which the logging server can locate Notification objects. At startup, the logging server scans its list of supported Notification containers and loads the included Notification object configurations in memory where they can be used to filter events and provide event notification.
The Notification container under Logging Services is automatically created during installation; however, Notification containers may be created anywhere in the tree.
IMPORTANT: The logging server only loads the Notification object configurations that are located in supported Notification containers. Therefore, if you create a new Notification container or Notification object, you must ensure the Notification container is included in the logging servers Notification container list.
To define event criteria, you must be familiar with event structure. All events have a fixed set of fields. Because the field structure is consistent across all events, the logging server can use these fields to filter events. When you define a Notification object, you specify a value for a given event field. To narrow the results, you can define values for multiple event fields. Using standard and, or, and not operators, you can define up to 15 event conditions.
NOTE: For more information on the event fields, see Event Structure.
Once you define the event criteria, you must select a notification channel. Notification channels are simply the Channel objects the logging server uses to provide event notification. For example, if you want to e-mail events to your mailbox, you must select an SMTP Channel object that is configured to relay events to your e-mail address. Similarly, if you want to log events to a MySQL database, you must select a MySQL Channel object that is configured to write events to the correct database and table. You can define multiple notification channels for any given Notification object.
To create a new Notification object,
In the Container list, checkmark the box next to the Notification container in which you want to create the Notification object. If the container you wish to use is not listed, you can add the Notification container.
Click New Notification. The New Notification menu appears.
Type a name for the object in the Notification Name field.
Select either Notification or Heartbeat Notification.
Click OK to create the Notification object.
After the Notification object is created, you must configure the object.
Notification objects can be configured from the Notifications tab in the logging server's Server Configuration task.
To configure a Notification object:
In the Container list, checkmark the box next to the Notification
object you want to configure. If the Notification object isn't
visible, click the plus icon
next to the object's Notification container to expand the object list.
Click Edit Notification. The Modify Object menu appears.
Modify Object menu |
||
Description |
This field allows you to enter a description and any necessary explanation for the Notification Filter. The field limit is 255 characters. NOTE: The information from this field is returned if one uses the SE event variable. For more information, see Event Field Variables.
|
|
Rule |
The Rule defines the filter criteria.
|
|
Event Field |
The event field on which the logging server filters events. All events have a fixed set of fields. Because the field structure is consistent across all events, the logging server can use these fields to filter events. For more information, see Event Structure.
|
|
Condition |
The condition under which the logging server applies the Value to the Event Field. Depending on the Event Field, you may select the following conditions from the drop-down list box:
|
|
Value |
A value specific to the designated Event Field that the logging server uses to filter events. The logging server applies the Value to the designated Event Field under the defined conditions. If an event matches the criteria, it is sent to the designated notification channel.
|
|
Operator |
To narrow the filter results, you can define values for multiple event fields. Using standard and, or, and not operators, you can define up to 15 event conditions. The conditions are accumulative; that is, the logging server applies the first, then the second, then the third, etc., to progressively narrow the results.
|
|
Notification Channels |
The Channel objects the logging server uses to provide event notification. You can define multiple notification channels for any given Filter object. Click the Browse button to select Channel objects in the tree.
|
|
Status |
By default, all Notification objects are enabled. This means that the logging server loads the Notification objects configuration in memory at startup. If the Notification object is disabled, the logging server does not load that objects configuration at startup. IMPORTANT: The Notification object must be located in a supported Notification container in order for the logging server to find it.
|
When finished modifying the Notification object, click OK.
IMPORTANT: The logging server loads the Notification object configurations from its supported Notification containers at startup. Therefore, if you modify a Notification object, you must restart the logging server for the changes to take effect. For information on restarting the logging server, refer to the Novell Nsure Audit Administration Guide.
For more information on Notification containers, see Adding and Removing Notification Containers.
For more information on the logging server, see Configuring the Secure Logging Server.
For more information on using Nsure Audit, see Nsure Audit Help.
A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party trademark. For information on trademarks, see Legal Notices.