(r15) APPXAuditLog < Main

Tags: view all tags
---+ APPX Audit Log Feature&nbsp; 

_This page describes the APPX Audit Log feature and provides instructions for&nbsp;enabling the APPX Audit Log feature._ 

%TOC% 
---++ Overview 

The APPX Audit Log feature creates an xml log of APPX file I/O&nbsp;activity.&nbsp; The feature can be enabled for individual files or for groups of files using the FMS group feature of APPX.&nbsp; The level of activity detail logged can be configured to optionally include read, write, rewrite, delete, create,&nbsp;and restructure events. 

To enable the APPX Audit Log feature, you must configure and start&nbsp;an instance of the APPX Audit Log Service, you must define a Log Profile in APPX System Administration, and you must assign the Log Profile to an FMS Group or to individual files. The APPX Audit Log Service receives logging requests from the various APPX sessions and writes the audit data to the log file. 
---++ Installing the APPX&nbsp;Audit Log Manager Command ( _appxAuditMgr_) 

The APPX Audit Log Manager ( _appxAuditMgr_) command is installed automatically when you install APPX on your system. The installer sets the necessary owner and group permissions for the appxAuditMgr command. So, there is nothing additional that you need to do to install the appxAuditMgr command. However, after you install APPX, you will need to run the appxAuditMgr command to configure and start an instance of the APPX Audit Log Service to enable logging of file audit information for APPX sessions. 

The appxAuditMgr command is installed into the "services" subdirectory of the directory where you installed APPX. So, if you installed APPX in "/usr/local/appx", the full pathname of the appxAuditMgr command will be "/usr/local/appx/services/appxAuditMgr". 

The appxAuditMgr command must run with the permissions of the root user. Therefore, the owner of the appxAuditMgr command should be the root user and the SUID bit should be set so that the appxAuditMgr command can be run by users other than root but still be run with the permissions of the root user. 

In the event that it is necessary to reset the permissions of the appxAuditMgr command, the following commands can be run by the root user to set the necessary owner and group permissions for the appxAuditMgr command. 

<blockquote>
<pre>
<p />cd /usr/local/appx/services
chown root appxAuditMgr
chgrp appxgrp appxAuditMgr
chmod 4775 appxAuditMgr
</pre>
</blockquote>

You can check the permissions of the appxAuditMgr command by running the following command: 

<blockquote>
<pre>
ls -l appxAuditMgr
</pre>
</blockquote>

The recommended permissions should be as follows: 

<blockquote>
<pre>
-rwsrwxr-x 1 root appxgrp    636843 Jul 11 07:31 appxAuditMgr
</pre>
</blockquote>
---++ Creating and Configuring&nbsp;an&nbsp;Audit Log Service 

On Unix/Linux systems, an instance of the APPX Audit Log Service is initially created, configured, and started by running the appxAuditMgr command with the __-install__ option. At least one appropriately configured instance of the APPX Audit Log Service must be created, configured, and started before&nbsp;running an APPX session for which file I/O activity is to be logged. You may create, configure, and start as many different instances of the APPX Audit Log Service as you desire. However, each concurrently running instance must be configured to&nbsp;receive file I/O&nbsp;audit&nbsp;data&nbsp;on a different TCP/IP port.&nbsp;&nbsp; Each instance of the Audit Log Service will log file I/O activity to&nbsp;a separate&nbsp;xml file.&nbsp; By creating more than one instance of the APPX Audit Log Service, you can separate the file I/O activity that is logged&nbsp;into separate files by assigning different Log Profiles to FMS groups&nbsp;or individual files. 
---+++ Creating an Audit Log Service 

Before file I/O activity can be logged,&nbsp;at least one instance of an APPX Audit Log Service must be configured and started. 

The __-install__ option of the appxAuditMgr command is used to initially create, configure, and start an instance of the APPX Audit Log Service. The following steps are performed: 
   1 A configuration file (ini) is created
   1 An environment file (env) is created
   1 A service is created, including required init files and links. ( On Red Hat, /etc/init.d/ )
   1 The service is started

When creating an instance of the APPX Audit Log Service, you must provide the Service Name, Service Type, and TCP/IP Port Number.&nbsp; For compete information on using the -install option of the appxAuditMgr command, please refer to the usage section of this page. 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
---++++ Service&nbsp;Name&nbsp; 

Each instance of an APPX Audit Log Service must have a unique name. When creating an instance of a service, the __-name__ option may be used to specify the name that you want the service to have. If you do not specify a name, a name will be assigned for you for example, appxd-8070. 
---++++ Service Type 

When creating an instance of an APPX Audit Log Service, the __-ServiceType__ option must be specified.&nbsp; The value of this option must be "logmonitor". 
---++++ TCP/IP Port Number 
When creating an instance of an APPX Audit Log Service, the __-SockPort__ option must be used to specify the TCP/IP port number on which the service is to listen for audit logging requests. Any available TCP/IP port number may be specified when installing an instance of the APPX&nbsp;Audit Log Service. However, as a matter of convention, most APPX administrators configure the APPX Audit Log Service to listen for audit log&nbsp;requests on port 8070. If additional instances of the APPX&nbsp;Audit Log Service are configured, each instance is typically assigned the next available port number after 8070. </blockquote>
---+++ Changing the Configuration of an Audit Log Service 

Two methods are available for modifying an existing instance of an APPX Audit Log Service. 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
---++++ Method 1 - The APPX Audit Log Manager Command (appxAuditMgr) 
The __-modify__ command and the __-replace__ command of the appxAuditMgr tool can be used to modify or replace a previously configured instance of the APPX&nbsp;Audit Log&nbsp;Service. These options update the existing APPX&nbsp;Audit Log&nbsp;Service configuration files (ini and env) with the options specified. If you use this technique, the service will be automatically restarted for you, using the new settings. Note that when specifying options on the command line, you must prefix them with a dash. 
---++++ Method 2 - Text Editor 
A text editor can be used to directly edit the APPX&nbsp;Audit Log Service configuration files (ini and env). The configuration files include comments to help you make the desired changes. If you use this method to modify an existing configuration, you should exercise care to ensure that the syntax is correct. The preferred method for modifying an APPX&nbsp;Audit Log&nbsp;Service configuration&nbsp;is with Method 1 above.&nbsp; When you edit the configuration files for an instance of the APPX Audit Log Service with a text editor, you must restart the service before the changes take effect.</blockquote>
---++ Managing an&nbsp;Audit Log&nbsp;Service 

Two methods are available for managing an existing instance of the APPX Audit Log Service. 
<blockquote>
---+++ Method 1 - appxAuditMgr command 

The appxAuditMgr command can be used to manage an instance of the APPX Audit Log Service. The appxAuditMgr command can be used to start, stop, restart, or display the status of an instance of an APPX Audit Log Service. The following example shows how to use the __appxLogMgr__ command to check on the status of an APPX Audit Log Service. 
<pre>
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr"><p />[root@500test services]# appxLogMgr -status appxLog8070 
up and running (process 2390 servicing port 8070)</blockquote>
</pre>
---+++ Method 2 - O/S Services&nbsp; 

Your operating system includes commands or programs that can be used to manage services. APPX Audit Log Services can be managed with these tools. The actual commands and programs vary depending on your operating system. Red Hat uses the __service__ command. The following example shows how to use the&nbsp;Red hat __service__ command to check on the status of an APPX Audit Log Service. 
<pre>
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr"><p />[root@500test services]# service appxLog8070 status 
up and running (process 2390 servicing port 8070)</blockquote>
</pre>
</blockquote>
---++ Usage (appxAuditMgr) 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
---+++ Synopsis - Service Configuration 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The appxAuditMgr service configuration commands are used to create, configure, and remove an instance of an APPX Audit Log Service. 

appxAuditMgr -install -ServiceType=logmonitor -SockPort=[TCP-Port] [options]... [VARIABLE=VALUE]... 

appxAuditMgr -modify -serviceName=SERVICENAME [options]... [VARIABLE=VALUE]... 

appxAuditMgr -replace -serviceName=SERVICENAME -ServiceType=logmonitor [options]... [VARIABLE=VALUE]... 

appxAuditMgr -remove -serviceName=SERVICENAME 
---++++ Configuration - Commands 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">

*-install* -name=SERVICENAME -ServiceType=logmonitor&nbsp;[options]... [VARIABLE=VALUE]... 

*-install* -port=PORT -ServiceType=logmonitor [options]... [VARIABLE=VALUE]... 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The __-install__ command is used to configure a new instance of an APPX Audit Log Service. Either form of the install command may be used. 

The first form of the __-install__ command requires only that a service name and service type&nbsp;be specified. All other options are optional including the TCP/IP port. Any option not specified will be configured with an appropriate default value. 

The second form of the __-install__ command requires only that a TCP/IP port and service type&nbsp;be specified. All other options are optional including the <nop>ServiceName. Any option not specified will be configured with an appropriate default value. 

Both forms of the __-install__ command allow additional configuration options to be specified. The configuration options specified&nbsp;are stored in the service configuration file (ini). 

Both forms of the __-install__ command optionally allow values to be specified for environment variables. If specified, the environment variables and their values are stored in the environment configuration file (env). There is currently no need to set any environment variables. 

In addition to creating the service configuration file and the environment configuration file, the __-install__ command also creates an operating system service that will be automatically started when the computer system is started. 

After creating the configuration files and the operating system service, the __-install__ command starts the service.</blockquote> *-modify* -name=SERVICENAME [options]... [VARIABLE=VALUE]... 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">

The __-modify__ command is used to modify the configuration of an existing Audit Log Service. The specified options will be updated in the service configuration files. Any options not specified will not be changed. After updating the configuration files, the __-modify__ command restarts the service. 

Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as DisplayName, or without a dash if you are referring to environment variables. 

Note that the __-modify__ command updates the service configuration file and the environment configuration file by removing the old files and creating new files with the updated options and environment variables.&nbsp; Any comments that may have been manually added to these configuration files are not preserved.</blockquote>

*-replace* -name=SERVICENAME -ServiceType=logmonitor&nbsp;[options]... [VARIABLE=VALUE]... 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The __-replace__ command is used to replace an existing Audit Log Service with a new Audit Log Service with the same name. The __-replace__ command is effectively the same as a __-remove__ command followed by an __-install__ command. After updating the configuration files, the __-replace__ command restarts the service. Note that when specifying variables on the command line, you must prefix them with a dash if you are referring to settings such as DisplayName, or without a dash if you are referring to environment variables. </blockquote>

*-remove* -name=SERVICENAME 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The __-remove__ command is used to remove an existing Audit Log Service. The __-remove__ command will remove the configuration files (ini and env) and the corresponding operating system service. If the service is running when the __-remove__ command is executed, the __-remove__ command will first stop the service and then remove the service.</blockquote></blockquote>
---++++ Configuration - Options 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
---+++++ Options - General 
*-name, -ServiceName=SERVICENAME* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The <nop>ServiceName uniquely identifies an APPX Audit Log Service. When creating (installing) an Audit Log Service, the SERVICENAME value may be any string value that conforms to the rules for valid filenames on your server. If this option is omitted when an&nbsp;Audit Log Service is being created, the Audit Log Service will be created with a default <nop>ServiceName based on the following template: "appxd-" followed by the specified TCP/IP port number, e.g "appxd-8060".</blockquote>

*-DisplayName=DISPLAYNAME* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">

The <nop>DisplayName is a "user-friendly" descriptive name for an Audit Log Service. The DISPLAYNAME value will appear in your system's Services control panel and will be displayed by the __ps__ command. If you don't specify a DISPLAYNAME when an Audit Log Service is being created, the Audit Log Service will be created with a DISPLAYNAME based on the SERVICENAME. </blockquote>

*-LogDirectory={<u>/tmp</u>, LOGDIR}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">When the service is started, two log files are created in the LOGDIR directory - an Audit Log Service log file (.log) and a status file (.stat). Both log files have the same name as the <nop>ServiceName but one has a file extension of .log and the other has a file extension of .stat. If the <nop>LogDirectory option is not specified, the log files are created in the /tmp directory.</blockquote>

*-ServiceType=logmonitor* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The only valid value when configuring an Audit Log Service is "logmonitor". Note: This option must be specified<font color="#000000">.</font></blockquote>

*-ServiceDisable={true, <u>false</u>}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">This option can be used to temporarily disable or "turn off" the Audit Log Service. If set to true, the Audit Log Service will still run but it will not accept&nbsp;requests to log data from APPX sessions.</blockquote>

*-initScript={lsb, <nop>RedHat}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">Used with -install option to specify the type of operating system that the service script is to be created for. If this option is not specified, appxAuditMgr will determine which type of service script to install.</blockquote>
---+++++ Options - Audit Log 
*-LogNamePattern={<u>/tmp/logmon%N.xml</u>, AUDITLOGPATHNAME}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">

The <nop>LogNamePattern identifies the path and the file name for the audit log files that will be created by the Audit Log Service.&nbsp; The&nbsp;value of AUDITLOGPATHNAME&nbsp;can include a pattern to ensure that the name of each file created by the Audit Log Service will&nbsp;be unique.</blockquote>

*-LogRotationInterval={<u>86400</u>, MAXSECONDS}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The <nop>LogRotationInterval identifies the maximum time in seconds that an Audit Log file should be used before&nbsp;being closed&nbsp;and&nbsp;a&nbsp;new audit log file is created.&nbsp; The default value of 86000 is the number of seconds in one day so,&nbsp;by default,&nbsp;the Audit Log Service will create a new audit&nbsp;log file each day</blockquote>

*-LogRotationSize={<u>1G</u>, MAXSIZE}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">The <nop>LogRotationSize is the maximum size that an Audit Log file is allowed to be.&nbsp; When an audit log file reaches the specified MAXSIZE, it will be closed and a new audit log file will be created.</blockquote>
---+++++ Options - TCP/IP 
*-port, -SockPort={<u>8060</u>, PORT}* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">Configure the service to listen for audit log requests on the specified TCP/IP PORT number. This option is required with the *-install* option. You may choose any TCP/IP PORT number that is not reserved or already being used on your system.</blockquote></blockquote></blockquote></blockquote>
---++++ Configuration - Environment Variables 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr"><u>VARIABLE</u>=<u>VALUE</u> 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">You can include a space-separated list of environment variables at the end of the command line when you use the -install option. These environment variables will be saved in the env file that is created.&nbsp; There is currently no reason to use this feature.</blockquote></blockquote>
---+++ Synopsis - Service Management 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr"> *appxAuditMgr* [-start | -stop | -restart | -status] {SERVICENAME | -serviceName=SERVICENAME} </blockquote>

*MANAGEMENT OPTIONS* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr"> *-start* | &lt; _blank_ &gt; 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">Start an instance of the&nbsp;Audit Log Service using the configuration information in the SERVICENAME.ini and the SERVICENAME.env files. </blockquote>

*-stop* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">Stop the instance of the&nbsp;Audit Log&nbsp;Service that was started with the SERVICENAME.ini file. </blockquote>

*-restart* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">Restart (stop and then start) the instance of the&nbsp;Audit Log Service that was started with the SERVICENAME.ini file. </blockquote>

*-status* 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">Report the status of the instance of the&nbsp;Audit Log Service that was started with the SERVICENAME.ini file. </blockquote></blockquote>

*EXAMPLES* 

Example 1 -&nbsp;Configure and start a new instance of the Audit Log Service that will listen for audit log requests on port 8070: 

*appxAuditMgr* *-install -port=8070 -ServiceType=logmonitor* &nbsp; 

Example 2 - Configure and start a new instance of the Audit Log Service that will listen for audit log requests on port 8070.&nbsp; The service name and descriptive name are also specified. 

*appxAuditMgr -install -port=8070 -name=appxLog8070 -displayName="Appx-Audit-Log(8070)"&nbsp;-ServiceType=logmonitor* 

Example 2 - Display the status of an instance of the Audit Log Service: 

*appxAuditMgr* *-status appxLog8070* 

Example 3 - Shutdown a running instance of the Audit Log Service: 

*appxAuditMgr* *-stop appxLog8070* 

Example 4 - Start a previously configured instance of the Audit Log Service: 

*appxAuditMgr* *-start appxLog8070* 

Example 5 - Modify the Display Name and the maximum size of the log of an existing service: 

*appxAuditMgr -modify -name=appxLog8070 -displayName="Big Audit Log" -LogRotationSize=10G* 

---++ The Configuration File (ini) 

Each instance of an APPX Audit Log Service has a configuration file that is used to store the various parameters relating to that specific instance of the Audit Log Service. 

The __-install__ option of the appxAuditMgr command creates the configuration file when the service is created. 

The name of the configuration file is the concatenation of the service name and ".ini". For example, if the service name is "appxLog8070", the name of the configuration file will be "appxLog8070.ini". 

The configuration file is created in whichever directory is your current directory at the time that the appxAuditMgr command is run to create the service. Therefore, before you run the appxAuditMgr command to create a service, you must first change to the directory where you want the configuration file to reside. For example, if you want the configuration file to be created in the APPX __services__ directory, you should change to the __services__ directory before you run the appxAuditMgr command. 

Once created, the name of the configuration file and the location of the configuration file should not be changed. The service that is created will not work correctly if the name or the location of the configuration file is changed. 

Note: The Configuration file for an APPX Audit Log service (as shown below)&nbsp;looks very much like the configuration file for an APPX Login Manager service.&nbsp;&nbsp;You should ignore the configuration options that do not apply to an APPX Audit Log service.&nbsp; Note that the extraneous options are all preceded by a "#" which causes them to be treated as comments.&nbsp; Although these&nbsp;extraneous options are of no consequence, they will be removed in a future release.&nbsp; 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
<pre>
<p /># Appx connection manager configuration file
#
#&nbsp;&nbsp; You can change this file by hand, or
#&nbsp;&nbsp; use the uappxd program for better results
#
#&nbsp;&nbsp; blank lines are ignored
#
#&nbsp;&nbsp; anything following a '#' is treated as a comment
#
#&nbsp;&nbsp; case is not important on the left-hand side
#&nbsp;&nbsp; properties whose descriptions end in a '?' are
#&nbsp;&nbsp; boolean and should be set to true or false
# --------------------------------------------------<p /># AppxApplication&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #startup application for spawned engines
# AppxDatabase&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #startup database for spawned engines
AppxExecutable&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /usr/local/appx500/appx#pathname to Appx engine
# AppxProcessName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #startup process name for spawned engines
# AppxProcessType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #startup process type for spawned engines
# AuthenticationMethod&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = OS-User&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #authentication method (OS-User, Appx-User, HT-User(filename))
DisplayName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = appxLog8070&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #descriptive name
# ImpersonateGID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = true&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #change effective grouo ID for spawned engines?
# ImpersonateGroup&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = User&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #[LogonUser, NamedGroup(groupname), ServiceOwner]
# ImpersonateUID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = true&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #change effective user ID for spawned engines?
# ImpersonateUser&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = LogonUser&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #[LogonUser, NamedUser(username), ServiceOwner]
# LoadSystemEnvironment&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = true&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #load default system-defined environment variables into spawned engines?
# LogDirectory&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /tmp&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #directory where log file should reside
# LogNamePattern&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = /tmp/appxlog%N.xml&nbsp; #audit log filename pattern (see man strftime for details
# LogRotationInterval&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 86400&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #number of seconds between audit log rotations
# LogRotationSize&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 1G&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #maximum audit log file size
# RequireSSL&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = false&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Require SSL-secured connections?
# RequireSSLClientCertificates = false&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #require SSL-client certificates?
# ServerCertificateFile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #pathname of server's X509 certificate (leave blank for anonymous connections
# ServerPrivateKeyFile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #pathname of server's private key file (unlocks the ServerCertificateFile)
# ServerPrivateKeyPassphrase =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #passphrase that unlocks ServerPrivateKeyFile
# ServiceDisable&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = false&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #disable this service?
# ServiceDisableAppxKeys&nbsp;&nbsp;&nbsp;&nbsp; = false&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #disable keyboard mapping?
# ServiceDisableFMS&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = false&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #disable AppxNET connections?
# ServiceDisableLogins&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = false&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #disable interactive logins?
# ServiceEnableCmds&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = true&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #allow client-side startup options?
ServiceName&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = appxLog8070&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #name of service
ServiceType&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = logmonitor&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #service type (login or logmonitor)
SockPort&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 8070&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #port number to service
# SSLMode&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = Optional&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #SSL connection type (optional, required, disabled)
# TCPEnableKeepAlive&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = true&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Enable TCP dead-connection detection
# TCPKeepCount&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 8&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Maximum number of keep-alive pings
# TCPKeepIdle&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 300&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Idle time before ping sent to client (in seconds)
# TCPKeepInterval&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = 60&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #Interval between keep-alive pings
# TCPNoDelay&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; = true&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #disable TCP packet filling delay?
# TrustedCAFile&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #determines which client certificates to trust
# Umask&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; =&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; #umask (file creation mask) given to spawned engines
</pre>
</blockquote>
---++ The Environment File (env) 

Each instance of an APPX Audit Log Service has an environment file that is used to store the environment variables relating to that specific instance of the Audit Log Service. However, there is currently no requirement to set any environment variables when configuring an APPX Audit Log service. 

The __-install__ option of the appxAuditMgr command creates the environment file when the service is created. 

The name of the environment file is the concatenation of the service name and ".env". For example, if the service name is "appxLog8070", the name of the environment file will be "appxLog8070.env". 

The environment file is created in whichever directory is your current directory at the time that the appxAuditMgr command is run to create the service. Therefore, before you run the appxAuditMgr command to create a service, you must first change to the directory where you want the environment file to reside. For example, if you want the environment file to be created in the APPX services directory, you should change to the services directory before you run the appxAuditMgr command. 

Once created, the name of the environment file and the location of the environment file should not be changed. The service that is created will not work correctly if the name or the location of the environment file is changed. 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
<pre>
# Appx connection manager environment variables
#
#   The entries in this file will become
#   environment variables in the engines
#   spawned by this service
#
#   blank lines are ignored
#
#   anything following a '#' is treated as a comment
#
#   letter case IS important in this file
# --------------------------------------------------
</pre>
</blockquote>
---++ The Status File (stat) 

When an APPX&nbsp;Audit Log Service is started, a status file is created in the specified <nop>LogDirectory. If a <nop>LogDirectory was not specified, then the status file is created in the /tmp directory. 

The name of the status file is the concatenation of the service name and ".stat". For example, if the service name is "appxLog8070", the name of the status file will be "appxLog8070.stat". 

The status file can be viewed to see the actual context within which the service is running. 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
<pre>
appxLog8070 running as process 8665
Effective User ID 0
Real User ID&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; 0
Configuration values follow
*Daemonize = true
*DontForkEngine = false
*InitScriptStyle = 
*SleepAfterFork = 
AppxApplication = 
AppxDatabase = 
AppxExecutable = /usr/local/appx500/appx
AppxProcessName = 
AppxProcessType = 
AuthenticationMethod = OS-User
DisplayName = AppxLog8070
ImpersonateGID = true
ImpersonateGroup = User
ImpersonateUID = true
ImpersonateUser = LogonUser
LoadSystemEnvironment = true
LogDirectory = /tmp
LogNamePattern = /tmp/appxlog%N.xml
LogRotationInterval = 86400
LogRotationSize = 1G
RequireSSL = false
RequireSSLClientCertificates = false
ServerCertificateFile = 
ServerPrivateKeyFile = 
ServerPrivateKeyPassphrase = 
ServiceDisable = false
ServiceDisableAppxKeys = false
ServiceDisableFMS = false
ServiceDisableLogins = false
ServiceDisableODBC = 
ServiceEnableCmds = true
ServiceName = AppxLog8070
ServiceType = logmonitor
SockPort = 8070
SSLMode = Optional
TCPEnableKeepAlive = true
TCPKeepCount = 8
TCPKeepIdle = 300
TCPKeepInterval = 60
TCPNoDelay = true
TrustedCAFile = 
Umask = 
Environment variables follow
Logging to /tmp/appxlog3.xml
</pre>
</blockquote>
---++ The Log File (log) 

When an APPX Audit Log Service is started, a log file is created in the specified <nop>LogDirectory. If a <nop>LogDirectory was not specified, then the log file is created in the /tmp directory. 

The name of the log file is the concatenation of the service name and ".log". For example, if the service name is "appxLog8070", the name of the log file will be "appxLog8070.log". 

When the Audit Log service is started, the log file is initialized with the configuration of the Audit Log service. The configuration information is followed by a dialog of messages relating to actions performed by the Audit Log service. Each time the Audit Log service processes a&nbsp;logging request, messages relating to the logging request are appended to the log file. 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
<pre>
*Daemonize = true
*DontForkEngine = false
*InitScriptStyle = 
*SleepAfterFork = 
AppxApplication = 
AppxDatabase = 
AppxExecutable = /usr/local/appx500/appx
AppxProcessName = 
AppxProcessType = 
AuthenticationMethod = OS-User
DisplayName = appxLog8070
ImpersonateGID = true
ImpersonateGroup = User
ImpersonateUID = true
ImpersonateUser = LogonUser
LoadSystemEnvironment = true
LogDirectory = /tmp
LogNamePattern = /tmp/appxlog%N.xml
LogRotationInterval = 86400
LogRotationSize = 1G
RequireSSL = false
RequireSSLClientCertificates = false
ServerCertificateFile = 
ServerPrivateKeyFile = 
ServerPrivateKeyPassphrase = 
ServiceDisable = false
ServiceDisableAppxKeys = false
ServiceDisableFMS = false
ServiceDisableLogins = false
ServiceDisableODBC = 
ServiceEnableCmds = true
ServiceName = appxLog8070
ServiceType = logmonitor
SockPort = 8070
SSLMode = Optional
TCPEnableKeepAlive = true
TCPKeepCount = 8
TCPKeepIdle = 300
TCPKeepInterval = 60
TCPNoDelay = true
TrustedCAFile = 
Umask = 
createListener complete - listening on port 8070
CAppxD::Run starting
monitorLog - starting
</pre>
</blockquote>

#RedHatServiceCommand 
---++ Red Hat service command. 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
---+++ Usage (service) 
<blockquote style="MARGIN-RIGHT: 0px" dir="ltr">
---++++ Synopsis - service Command 

service&nbsp;[serviceName]&nbsp;[start|stop|restart|status] </blockquote></blockquote>
---++ Examples:
---++ Warnings:
---++ Issues:
---++ Enhancement Suggestions
---++ Notes 
---+++ More About Log Profiles

Before data can be written to the log file in XML format, you need to define a Log Profile for the monitor. 

To define FMS group, go to System Administration, Configuration, Log Profile press F9 to add a new profile. You can name it anything you want. For server name you must give it your server name:port number that you created earlier with appxAuditMgr: 

<span style="FONT-SIZE: 12pt; FONT-FAMILY: 'Times New Roman'"><?XML:NAMESPACE PREFIX = V  /><V:SHAPETYPE id=_x0000_t75 filled="f" o:preferrelative="t" stroked="f" o:spt="75" _moz-userdefined="" coordsize="21600,21600" path="m@4@5l@4@11@9@11@9@5xe"><V:STROKE _moz-userdefined="" joinstyle="miter"></V:STROKE><V:FORMULAS _moz-userdefined=""><V:F _moz-userdefined="" eqn="if lineDrawn pixelLineWidth 0"></V:F><V:F _moz-userdefined="" eqn="sum @0 1 0"></V:F><V:F _moz-userdefined="" eqn="sum 0 0 @1"></V:F><V:F _moz-userdefined="" eqn="prod @2 1 2"></V:F><V:F _moz-userdefined="" eqn="prod @3 21600 pixelWidth"></V:F><V:F _moz-userdefined="" eqn="prod @3 21600 pixelHeight"></V:F><V:F _moz-userdefined="" eqn="sum @0 0 1"></V:F></V:FORMULAS></V:SHAPETYPE>servername:8064</SPAN> 
<P>Then click on Log File Parameters and make sure you check parameters that you wish to log: 
<P>Now you are ready to define a new FMS group for the monitor. 
<P>To add a new FMS group you need to go to System Administration, Configuration, File System Groups and press F9 to add a new one for the monitor. 
<P>Give it an FMS group of 1 and click on 'FMS group attributes' button. On that screen enter the name of your Log Profile in the 'Log Profile' field. Note that if you already have an FMS group that is used by the file(s) you wish to monitor, you can simply add the Log Profile name to the existing FMS group. If the FMS group refers to a RDBMS (such as Oracle, SQL Server, etc), then only changes made by Appx will be logged. 
<P>You can now assign this FMS group to the file(s) that you wish to monitor. </P>
<H3 class=TML>More About the xml Audit Log file</H3>
<H4 class=TML>Using a&nbsp;Pattern in a Log File Name</H4>
<P>Once you have created this new Service Type, it will create .ini and .env files for you. In our example, appxAuditMgr will create myLogMonitor.ini and myLogMonitor.env files in the ./services directory. You can change the name of the log file (which defaults to /tmp/appxlog%N.xml) by setting the <A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> in the myLogMonitor.ini file. You can also change the <A href="http://wiki.appx.com/wiki/bin/view/Main/LogRotationInterval">LogRotationInterval</A> and <A href="http://wiki.appx.com/wiki/bin/view/Main/LogRotationSize">LogRotationSize</A>. 
<P>Since we rotate audit logs, you specify a <A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> instead of just a filename. The pattern can include %N (which is translated to a monotonically increasing counter: 0, 1, 2, ..) or any of the date/time format specs. supported by the strftime() function (see 'man strftime' for a list of the patterns). For example, a <A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> of '/tmp/appx_%F.xml' would generate names like: 
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<P>/tmp/appx_2007-01-31.xml 
<P>/tmp/appx_2007-02-28.xml </P></BLOCKQUOTE>
<P>The default pattern (as reflected in the <I>serviceName.</I> ini file) is: 
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px"><A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> = /tmp/appxlog%N.xml </BLOCKQUOTE>
<P>Each time the log monitor rotates to a new log file, it replaces %N with the next number in sequence (it was always starting at 0). You can use other specifiers in the <A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> too, for example, "/tmp/appx-%D-%B-%Y" would result in file names like: 
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px"><CODE>/tmp/appx-11-Jun-08</CODE> 
<P><CODE>/tmp/appx-12-Jun-08</CODE> 
<P><CODE>...</CODE> </P></BLOCKQUOTE>
<P>If you restart the log monitor on 11-Jun-08 (and your <A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> specifies %D-%B-%Y), any existing log file with that name would be replaced. Of course, you can include time components in the <A href="http://wiki.appx.com/wiki/bin/view/Main/LogNamePattern">LogNamePattern</A> to avoid that problem (or add %N to the pattern to include a sequence number). Here's the complete list of valid specifiers (from the strftime man page): 
<P></P><PRE class=TMLverbatim>%a The abbreviated weekday name according to the current locale.
%A The full weekday name according to the current locale.
%b The abbreviated month name according to the current locale.
%B The full month name according to the current locale.
%c The preferred date and time representation for the current locale.
%C The century number (year/100) as a 2-digit integer. (SU)
%d The day of the month as a decimal number (range 01 to 31).
%D Equivalent to %m/%d/%y. (Yecch -- for Americans only. Americans should note that in other coun-
tries %d/%m/%y is rather common. This means that in international context this format is ambiguous and should not be used.) (SU)
%e Like %d, the day of the month as a decimal number, but a leading zero is replaced by a space. (SU)
%E Modifier: use alternative format, see below. (SU)
%F Equivalent to %Y-%m-%d (the ISO 8601 date format). (C99)
%G The ISO 8601 year with century as a decimal number. The 4-digit year corresponding to the ISO week number (see %V). This has the same format and value as %y, except that if the ISO week number belongs to the previous or next year, that year is used instead. (TZ)
%g Like %G, but without century, that is, with a 2-digit year (00-99). (TZ)
%h Equivalent to %b. (SU)
%H The hour as a decimal number using a 24-hour clock (range 00 to 23).
%I The hour as a decimal number using a 12-hour clock (range 01 to 12).
%j The day of the year as a decimal number (range 001 to 366).
%k The hour (24-hour clock) as a decimal number (range 0 to 23); single digits are preceded by a blank. (See also %H.) (TZ)
%l The hour (12-hour clock) as a decimal number (range 1 to 12); single digits are preceded by a blank. (See also %I.) (TZ)
%m The month as a decimal number (range 01 to 12).
%M The minute as a decimal number (range 00 to 59).
%n A newline character. (SU)
%O Modifier: use alternative format, see below. (SU)
%p Either `AM' or `PM' according to the given time value, or the corresponding strings for the current locale. Noon is treated as `pm' and midnight as `am'.
%P Like %p but in lowercase: `am' or `pm' or a corresponding string for the current locale. (GNU)
%r The time in a.m. or p.m. notation. In the POSIX locale this is equivalent to `%I:%M:%S %p'. (SU)
%R The time in 24-hour notation (%H:%M). (SU) For a version including the seconds, see %T below.
%s The number of seconds since the Epoch, that is, since 1970-01-01 00:00:00 UTC. (TZ)
%S The second as a decimal number (range 00 to 60). (The range is up to 60 to allow for occasional leap seconds.)
%t A tab character. (SU) %T The time in 24-hour notation (%H:%M:%S). (SU)
%u The day of the week as a decimal, range 1 to 7, Monday being 1. See also %w. (SU)
%U The week number of the current year as a decimal number, range 00 to 53, starting with the first Sunday as the first day of week 01. See also %V and %W.
%V The ISO 8601:1988 week number of the current year as a decimal number, range 01 to 53, where week 1 is the first week that has at least 4 days in the current year, and with Monday as the first day of the week. See also %U and %W. (SU)
%w The day of the week as a decimal, range 0 to 6, Sunday being 0. See also %u.
%W The week number of the current year as a decimal number, range 00 to 53, starting with the first Monday as the first day of week 01.
%x The preferred date representation for the current locale without the time.
%X The preferred time representation for the current locale without the date.
%y The year as a decimal number without a century (range 00 to 99).
%Y The year as a decimal number including the century.
%z The time-zone as hour offset from GMT. Required to emit RFC 822-conformant dates (using "%a, %d %b %Y %H:%M:%S %z"). (GNU)
%Z The time zone or name or abbreviation.
%+ The date and time in date(1) format. (TZ) (Not supported in glibc2.)
%% A literal '%' character. 
</PRE>
<H3>How to Rotate the Audit Log File</H3>
<P>To close existent log file and rotate the log, you need issue the following command: 
<BLOCKQUOTE dir=ltr style="MARGIN-RIGHT: 0px">
<P>kill -s SIGUSR1 &lt;PID&gt;</P></BLOCKQUOTE>
<P>where PID is a process ID of the audit log listener. Existent log will be closed and rotated to the next one. 
<H3>How to View Audit Log Events</H3>
<P>The log file is generated in XML format. Why XML, and not Appx/IO? The biggest reason is the size of the log files. On large, active systems the number of events can exceed the maximum file size. </P>
<P>You can view the log file with a browser, with XML Notepad, or you can download SQL Express (free) and write queries against your XML file. You can also use the various xlst processing programs to create queries (such as xsltproc or xalan from Apache). </P>
<H4>Microsoft XML Notepad</H4>
<H4>Web Browser</H4>
<H4>xslt</H4>
<H4>Databases</H4>
<P>XML files can easily be imported into a RDBMS, which does not have the same file size limitation. 
<H3>Audit Log Events</H3>
<P>Each Audit Log document contains one primary enclosing &lt;events&gt; node which contains one or more &lt;event&gt; nodes. Each &lt;event&gt; node contains an eventID node which has a &lt;type&gt; element that identifies the type of event that is being logged. A variety of additional nodes (shown in the table below) are included in each &lt;event&gt; node depending on the value of the &lt;type&gt; element. The following values may occur for the &lt;type&gt; element: 
<P>%TABLE{ sort="off" tableborder="2" cellborder="2" }% 
<TABLE cellSpacing=1 cellPadding=0 border=1>
<TBODY>
<TR>
<TD><B>type</B> </TD>
<TD><B>eventID</B> </TD>
<TD><B>sessionID</B> </TD>
<TD><B>fileID</B> </TD>
<TD><B>appxProcessID</B> </TD>
<TD><B>eventRecordID</B> </TD>
<TD><B>eventData</B> </TD>
<TD><B>Structure</B> </TD></TR>
<TR>
<TD>Read </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>Indexed Files </TD>
<TD>Yes </TD>
<TD>No </TD></TR>
<TR>
<TD>Update </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>Indexed Files </TD>
<TD>Yes </TD>
<TD>No </TD></TR>
<TR>
<TD>Insert </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>Indexed Files </TD>
<TD>Yes </TD>
<TD>No </TD></TR>
<TR>
<TD>Delete </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>Indexed Files </TD>
<TD>Yes </TD>
<TD>No </TD></TR>
<TR>
<TD>Scratch </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>No </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD><A href="http://wiki.appx.com/wiki/bin/view/Main/FileCreate">File Create</A> </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>No </TD>
<TD>%SPAN%</TD>
<TD>Yes </TD></TR>
<TR>
<TD>Restructure </TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>
<CENTER>Yes</CENTER></TD>
<TD>No </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR></TBODY></TABLE>
<P>
<TABLE cellSpacing=1 cellPadding=0 border=1>
<TBODY>
<TR>
<TD><B>node</B> </TD>
<TD><B>node/element</B> </TD>
<TD><B>value</B> </TD></TR>
<TR>
<TD>&lt;eventID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;type/&gt; </TD>
<TD>see above table </TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;timeStamp/&gt; </TD>
<TD>ccyymmddhhmmsstt </TD></TR>
<TR>
<TD>&lt;/eventID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;sessionID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;processID/&gt; </TD>
<TD>9(6) </TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;userID/&gt; </TD>
<TD>X(3) </TD></TR>
<TR>
<TD>&lt;/sessionID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;fileID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;application/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;database/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;structureDate/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;filename/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/fileID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;appxProcessID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;type/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;name/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;application/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;version/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;database/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;lastChange/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/appxProcessID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;eventRecordID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;keySegment&gt; </TD>
<TD>0-16 instances </TD></TR>
<TR>
<TD>&lt;/eventRecordID&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;keySegment&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldName&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldValue&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/keySegment&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;eventData&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;field&gt; </TD>
<TD>0-n instances </TD></TR>
<TR>
<TD>&lt;/eventData&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;field&gt; </TD>
<TD>%SPAN%</TD>
<TD>read, insert, delete </TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldName&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;occurrence&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldValue&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/fieldData&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;fieldData&gt; </TD>
<TD>%SPAN%</TD>
<TD>update </TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldName&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;oldValue&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;newValue&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/fieldData </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;Structure&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;Field&gt; </TD>
<TD>1-n instances </TD></TR>
<TR>
<TD>&lt;/Structure&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;Field&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldName&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldType&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;occurrences&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;rawLength&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;offset&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/Field&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;eventData&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;RecordSizeChange&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;DeletedElement&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/eventData&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;RecordSizeChange&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;old&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;new&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/RecordSizeChange&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;DeletedElement/&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>%SPAN%</TD>
<TD>&lt;fieldName/&gt; </TD>
<TD>%SPAN%</TD></TR>
<TR>
<TD>&lt;/DeletedElement&gt; </TD>
<TD>%SPAN%</TD>
<TD>%SPAN%</TD></TR></TBODY></TABLE>
<P>
<H2 class=TML>Sample scripts </H2>
<P>Here are some sample xslt processing commands that you can use to do inquiries against the raw XML data. 
<P>The attached file 'structure.xslt' will extract any file create events from a log and produces an HTML table that shows the structure of each file that you create. 
<P>The attached file 'subrs.xslt' extracts all events where the process type is SUBR and produces an HTML summary table that shows the user id, date, time, event ID, application ID, version, and process name. 
<P>To use a stylesheet with xsltproc (the XSLT processor from libxml/xmlsoft): 
<P>$ xslt stylesheetFileName logFileName &gt;output.html 
<P>for example: 
<P>$ xslt /stylesheets/structure.xslt /tmp/appxlog0.xml &gt; /tmp/fileCreates.html 
<P>To use a stylesheet with xalan (the XSLT processor from Apache): 
<P>$ xalan -xsl stylesheetFileName &lt;logFileName &gt;output.html 
<P>for example: 
<P>$ xalan -xsl /stylesheets/structure.xslt &lt; /tmp/appxlog0.xml &gt; /tmp/fileCreates.html 
<P><B>Need examples of loading XML Data into an RDBMS</B> 
<P>
<H2 class=TML>NOTES: </H2>
<P>If log file is not closed/rotated properly, Internet Explorer will display your .xml file, but it will show an error at the end of the file saying "File not closed". Firefox, however, will throw an error and won't display file at all 
<P>In Linux, the way to close log and rotate it is to issue kill -s SIGUSR1 PID command. 
<P><SPAN style="COLOR: crimson">How to close and rotate the log in Windows?</SPAN> 
<H2 class=TML>Comments: </H2>
<P><I>Read what other users have said about this page or add your own comments.</I> 
<P>
<HR class=TMLhr>
<P>%COMMENT% 
<P>-- <A href="http://wiki.appx.com/wiki/bin/view/Main/SteveFrizzell">SteveFrizzell</A> - 20 Jun 2008 </P></BODY></html>
%META:FILEATTACHMENT{name="subrs.xslt" attachment="subrs.xslt" attr="" comment="xslt program to extract subroutine calls" date="1219770177" path="subrs.xslt" size="1866" stream="subrs.xslt" user="Main.JeanNeron" version="1"}%</span>