vlog (8)

Prints Unicode 16 (NSS paths) in \uXXXX format. Without this option, Unicode 16 is output in UTF-8 format.

Blocks events (of type NSS) from the specified NSS volume from audit record stream. This option is followed by exactly one NSS volume name. This option can be specified multiple times on the command-line to specify multiple NSS volumes.

Sets the NSS Auditing client key to CLIENT-KEY. If this option is not specified, the default client key of "Zarahemla" is used. The CLIENT-KEY value is required to attach a new instance of vlog to a pre-existing NSS Auditing client data stream.

Sets the NSS Auditing client name to CLIENT-NAME. The CLIENT-NAME value length is limited to 1 to 15 bytes long, and must be unique on the system.

If this option is not specified, vlog generates a unique, random NSS Auditing client name (and is not limited to the 1 to 15-byte-length limit of this option). The CLIENT-NAME value is required to attach a new instance of vlog to a pre-existing NSS Auditing client data stream.

Uses daemon mode, which causes vlog to run in the background. All output directed to stdout or stderr is eliminated.

Specify a new extension for the log file that was renamed (-R option). If no extension is specified, it will continue with the extension of the original file.

Sets the output format using the specified format as follows:

Specifies a path to a filter file that contains filter patterns to be applied to the auditing records that are received from the NSS Auditing Engine (vigil). This option can be specified multiple times on the command-line to specify multiple filter file paths. See Filtering Records for further details.

Causes vlog to display a help page, then terminate.

Keeps unprocessed log files upon program termination. Log files represent the auditing data stream between the NSS Auditing Engine and vlog. The vlog files are stored in directory

/var/log/audit/vlog/{clientName}/

If this option is not specified, vlog destroys this directory, along with all of its content (including the cursor file, if it is implemented), when vlog terminates.

Sets the NSS Auditing client flag VIGIL_CLIENT_F_KEEP, which causes vlog to leave the NSS Auditing client data stream open upon normal termination, and creates an orphaned NSS Auditing client data stream. If this option is not specified, the VIGIL_CLIENTF_KEEP flag is not set, causing the NSS Auditing client data stream to close upon normal vlog termination.

Limits the NSS Auditing client's audit log file to the SIZE-IN-BYTES (before rolling to a new file).

Specify the maximum log file size in bytes. If the specified value is not a multiple of 4096 bytes (4 KB), it is automatically rounded up to the nearest 4-KB block. By default, the log file size is 262144 bytes (256 KB). The minimum log file size is 36864 bytes (36 KB). A SIZE-IN-BYTES value of zero [0] indicates no limit.

The rollover to a new log file occurs based on space available for writes as you approach the maximum file size. Thus, the file sizes of log files might not exactly match the expected maximum size when you view their sizes in bytes. If you view their file sizes in kilobytes, all of the files will be the same size.

Specify the vlog log file path. The default log file location is /var/log/audit. The vlog file will be created in the specified location.

Limit the vigil auditing client’s log files count. The default value for the maxStreamFileCount is set to zero (unlimited). If you have set a limit, after the number of stream files reaches the maxStreamFileCount value, the oldest audit streamfile is deleted to accommodate the newest data.

Redirects vlog output from stdout to the specified FILE-PATH.

Causes vlog to send output to the Linux Auditing Framework (LAF). This option does not cause output to stop being sent to stdout (or as redirected by the [-o, --outputFile] option). Rather, this option causes output to also be sent to LAF.

Adds a filter pattern, which filters records in the NSS Auditing data stream from vlog output. This option is followed by exactly one filter pattern. This option can be specified multiple times on the command-line to indicate multiple filter patterns. See Filtering Records for further details.

Causes vlog to implement a cursor file to track the current position in the NSS Auditing client data stream. The memory-mapped file contains both the path of the current audit log file being processed, as well as the offset of the audit record being processed in that file. If vlog unexpectedly terminates, the cursor file preserves this information, allowing a future instance of vlog to reconnect to the NSS Auditing client data stream, and continue processing records in the stream, in the same audit log file, and at the same record offset, where the prior (terminated) vlog instance had stopped. The cursor file is stored in the same directory as the audit log file(s):

/var/log/audit/vlog/{clientName}/

Limits the NSS Auditing client's audit log file to NUMBER-OF-RECORDS records before rolling to a new file. A NUMBER-OF-RECORDS value of zero [0] indicates no limit. If this option is not specified, the default value for NUMBER-OF-RECORDS is zero [0].

Specify the size of a vlog audit file (in megabytes). On exceeding the size, the file rolls over to a new file and is renamed as "filename_timestamp.log". If the specified value is not a multiple of 4096 bytes (4 KB), it is automatically rounded up to the nearest 4 KB block.

The log file size; maximum: 100 megabytes (MB) and minimum: 256 kilobytes (KB).

For example, ./src/vlog -R 50 -o ~/debug/john/vlog_events.log

A new file “T_<timestamp>.log” is created after vlog_events.log file reaches 50 MB. For the size in KB, suffix the size with the KB unit.

Causes vlog to set the NSS Auditing client flag: VIGIL_CLIENT_F_SHARE. This flag allows another instance of vlog to attach to the NSS Auditing data stream. Without this option, other instances of vlog are unable to connect the NSS Auditing data stream created by this client.

Specify an extension for the trigger files. By default, the CEF format displays the extension as cef_ready. The other formats will not have any extension.

Sets the NSS Auditing client user key to USER-KEY. If this option is not specified, the default value of Teancum is used as the client user key.

Sets the NSS Auditing client user name to USER-NAME. If this option is not specified, vlog generates a unique, random, NSS Auditing client user name for the vlog instance.

Debugging option. Increments the vlog's (error and warning) verbose level by one, and reports the verbose level. Use the -V option to specify a verbose level. Verbose messages are sent to stderr, and to the system message log.

Debugging option. Sets vlog's (error and warning) verbose level to the specified value. Verbose messages are sent to stderr, and to the system message log. Each level includes the messages of the lower levels.

For example, to set the verbose level to 22, enter

/opt/novell/vigil/bin/vlog -V 22 

The verbose messages for fatal errors, configuration changes, and internal modes are sent to stderr.

Closes the specified auditing client data stream before opening (or re-opening) the NSS Auditing client data stream. Requires that the [-C, --clientName] and [-c, --clientKey] options be previously specified on the command line.

If this option is not specified, vlog first attempts to re-attach to a pre-existing NSS Audit data stream; and opens a new NSS Audit data stream if the attempt to attach to a pre-existing stream fails.

Causes vlog to terminate immediately. This option is used internally by vlog when vlog calls itself recursively (as does the [-Z --libraryLinkage] option).

Debugging option. Causes vlog to display libvigil linkage information, and terminates.

Filter pattern debugging option. Causes vlog to validate filter patterns, and terminates. Filter patterns specified with the [-p, --pattern] and [-F, --filterFile] options are validated.

Include: Matches all events on any file in the VOL1:/abc directory. The events on files in subdirectories are not included. It will not match the directory “abc”.

Include: Matches all events on any file in the VOL1:/abc directory and any of its subdirectories. It will not match the directory “abc”.

Include: Matches only OPEN and CLOSE events on any file in the VOL1:/abc directory. The events on files in subdirectories are not included.

Include: Matches all events except the OPEN and CLOSE events on any file in the VOL1:/abc directory.

Include: Matches only NSS OPEN and NSS CLOSE events on any file in the VOL1:/abc directory.

Include: Matches all events except the NSS OPEN and NSS CLOSE events on any file in the VOL1:/abc directory.

Include: Matches all events except the non-NSS OPEN and non-NSS CLOSE events on any file in the VOL1:/abc directory.

Exclude: Matches all events for the VOL1:/abc/def file. This exclusion causes all events on the VOL1:/abc/def file to be dropped (assuming that they had been included by an include rule).

Exclude: Matches OPEN events for the VOL1:/abc/def file. This exclusion effectively excludes OPEN events on the VOL1:/abc/def file.

Include: Matches all events except the OPEN event on the VOL1:/abc/def file. This is another way to exclude OPEN events on the VOL1:/abc/def file.

Exclude: Matches all events except the OPEN event on the VOL1:/abc/def file. This effectively excludes all events except the OPEN event on the VOL1:/abc/def file (assuming they had been included by an include rule).

Include: Matches all events on any file in the VOL1:/xyz dir directory. Quotation marks are used to enclose the pattern when the path contains spaces. Otherwise, the space in "xyz dir" is treated as a delimiter between the pattern and the events.

Include: Matches all events on any file in the VOL1:/xyz dir. A backslash (\) is used to escape the space character in the directory name xyz dir. Otherwise, the space in xyz dir is treated as a delimiter between the pattern and the operations.

Include: Matches all events for all the users on "VOL1:/abc".

Include: Matches all events for all the users other than "root" on "VOL1:/abc". This is a way to exclude all events by the "root" users on the "VOL1:/abc".

Exclude: Matches all events by the "admin" user on the "VOL1:/abc". This effectively excludes all the events by the "admin" user on the "VOL1:/abc".

Exclude: Matches all events by the eDirectory user "tom" and Active Directory user "Joe" on the "VOL1:/abc". This effectively excludes all the events by the users "tom" and "Joe" on the "VOL1:/abc".

Include: Matches all events for the applications other than "nbackup" for only the root user on "VOL1:/abc". This excludes all nbackup events by the "root" user on the "VOL1:/abc".

Exclude: Matches all events for the application nbackup by the "admin" user for the "VOL1:/abc". This excludes all the nbackup events by the "admin" user on the "VOL1:/abc".