Setting AUDITFILE Emitter Properties (deprecated)

Note: Audit Manager is deprecated and provided for backward compatibility only. We recommend that you use syslog events instead. See Enterprise Server Auditing for more information.

Syntax:

In the Audit Manager Configuration file, you use the following line to specify the AUDITFILE emitter output properties.

mfaudit.emitter.emitter-name#property=property-value

Parameters:

emitter-name The name of the audit emitter for which the property is to be set.
property-name The name of the emitter property to set.
property-value The value of the emitter property to be set. Emitter names and property names are case-insensitive. See the table below for details.
property-value Description
AuditfileExit The name of a DLL(Windows) or shared object (Unix/Linux) that is to be invoked by the AUDITFILE emitter to report on emitter status changes (see AUDITFILE User Exit). The name of the exit specified should reside in a directory on PATH (Windows) or LIBPATH / LD_LIBRARY_PATH / SHLIB_PATH on Unix/Linux.
CollectionSize The number of audit files that will be created in a collection.

Used in conjunction with MaxFileSize.

Default: 5. Maximum 10.
File The name of the audit file to be written.

The following pseudo-variables may be used for the construction of the audit file name:

  • $(AUDITID) - the name of the audit event consolidator that invoked this emitter.
  • $(GEN) - the generation of the file starting from 1.
Default: mfaudit.$(AUDITID).aud_$(GEN)

For example, the second file in the audit file collection created by this emitter when invoked by the audit event consolidator named nwb-cpjdell would be: mfaudit.nwb-cpjdell.aud_2

Note: If the $(GEN) pseudo-variable is not included in the file specification, this emitter appends it.
Location The directory where the audit files are to be written.

Default: the location specified by the MFAUDIT_LOGS environment variable or the current directory if MFAUDIT_LOGS is not set. The emitter will write an error event to the to the Unix syslog, if it is unable to create audit files in the specified directory.

Note: The Audit Manager attempts to create the output audit file location if it does not already exist. If the creation of the directory specified by the Location property fails, it will use the default location. If the creation of the directory specified by the MFAUDIT_LOGS environment variable fails, the current directory will be used.
MaxFileSize The directory where the audit files are to be written.

The maximum size of an audit file in KB that will be written before the file is closed, and the next audit file in the collection is opened.

A file in the collection is identified by the $(GEN) pseudo-variable (see File property above). The first audit file in a collection will result in the $(GEN) pseudo-variable being set to 1, the second in the sequence will result in it being set to 2, and so on until CollectionSize is exceeded. Once the CollectionSize number of files has been reached, the sequence number will revert back to 1.

Default: 0x00005000, indicating 20 MB max file size

Comments:

mfaudit.emitter.emitter-name#property is used to set a property with the a name and value for the given emitter. Any property name and value can be set, irrespective as to whether the emitter will actually make use of it. The CBL_AUDIT_EMITTER_PROPERTY_GET API can be used by an emitter to retrieve property values as strings or numeric values.

Multiple mfaudit.emitter.emitter-name#property entries can occur in the configuration file, but for duplicates, the last-most entry is used.

Property names are case insensitive.

When any of the following common case-insensitive property values are used, they are held in two forms: the string as given, and a corresponding numeric value. An emitter can then use the CBL_AUDIT_EMITTER_PROPERTY_GET API to retrieve the numeric value of the property directly without needing to perform its own string conversion.

String Value Numeric Value
ON 1
OFF 0
YES 1
Y 1
NO 0
N 0
TRUE 1
FALSE 0
ENABLED 1
DISABLED 0
numeric-string n

Examples:

Set the audit file name, the number of files in the audit file collection, and the maximum size of each audit file in the backup set for the AUDITFILE emitter.

...
mfaudit.emitter.auditfile#collectionsize=3
mfaudit.emitter.auditfile#location=e:\audit
mfaudit.emitter.auditfile#file= myaudit.aud_$(GEN)
mfaudit.emitter.auditfile#maxfilesize=200
...

Audit files myaudit.aud_1, myaudit.aud_2, and myaudit.aud_3 are created in the directory e:\audit. Each of these files has a maximum size of 200kb.