VLOG Utility Man Page
17
n
ov
do
cx (e
n)
16
Ap
ril 20
10
Filtering Records
The
vlog
application supports filtering of events, as they are received from the NSS Auditing
Engine (
vigil
), by using filter patterns. Filter patterns are rules for filtering events. You can use
either of the following methods to specify filter patterns:
A filter file of filter patterns (consisting of one filter pattern per line) can be specified with the
[-F, --filterFile]
command line option. This option must be followed by a
[path/
]filename
.
A filter file can contain comment lines. Comment lines begin with a pound sign (
#
) or a double
forward slash (
//
).
Individual filter patterns can be specified with the
[-p, --pattern]
command line option.
This option must be followed by a quoted filter pattern.
There are two kinds of patterns that can be specified from a filter file by using the
[-F, --
filterFile]
option, or specified individually in the command by using the
[-p, --pattern]
option.
Patterns for filtering records of type VIGIL
Patterns for filtering records of type NSS, NCP, and CIFS
Each of these pattern types are discussed below.
Patterns for Filtering Records of Type VIGIL
Records of type VIGIL represent operations internal to the NSS Auditing Engine. By default,
records of type VIGIL are not filtered from
vlog
's output.
“Filter Syntax for Type VIGIL Records” on page 17
“Filter Keywords for Type VIGIL Records” on page 18
“Examples for Filtering VIGIL Events” on page 19
Filter Syntax for Type VIGIL Records
The general pattern for filtering records of type VIGIL is:
:[+ or -]KEYWORD [[+ or -]KEYWORD]
A pattern used to filter records of type VIGIL has a colon (
:
) as the first character of the pattern.
The colon is followed by one or more keywords that represent records that are to be included or
excluded from the
vlog
output. Multiple keyword entries are separated by a space. Keywords are
applied in the order that they appear in the filter pattern.
The specified keyword causes specific records of type VIGIL to be included or excluded from the
output. Each keyword is preceded by an exclude/include character that indicates whether the records
that match the specified pattern should be excluded or included in the
vlog
output. A minus (
-
)
character indicates that the records that are represented by the keyword that follows it should be
excluded from the
vlog
output. A plus (
+
) character indicates that the records that are represented
by the keyword that follows it should be included in the
vlog
output
Summary of Contents for OPEN ENTERPRISE SERVER 2 SP2 - STORAGE SERVICES AUDITING CLIENT LOGGER UTILITY REFERENCE 04-29-2010
Page 4: ...4 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 6: ...6 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 8: ...8 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 12: ...12 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 32: ...32 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
