20
OES 2 SP2: NSS Auditing Client Logger (VLOG) Utility Reference
n
ov
do
cx (e
n)
16
Ap
ril 20
10
Filter Syntax for Type NSS, NCP, and CIFS Records
[
negation_element
]
path_element
(event [event...])
Patterns for filtering records of type NSS, NCP and CIFS consist of three elements in the following
order:
1. Negation Element:
Indicates whether records that match the specified filter patterns that
follow are to be included or excluded from the auditing log. The negation element, if present, is
immediately followed by the path element.
2. Path Element:
A filename-matching pattern or directory-name-matching pattern that specifies
directories or files to include or exclude from the audit log. The path element is delimited from
the event element by a [space or tab] character.
3. Event Element:
A list of NSS file system events enclosed in parenthesis to include or exclude
from the audit log.
The options for each of the elements is described below.
Negation Element Options
The negation element is a single character that is used to indicate whether the specified filter
patterns are to be included or excluded from the auditing log.
The negation element is a single character that precedes the path element:
! (exclamation mark character)
Used to negate the filter patterns specified in a filter file when the command line filter file
option
[-F, --filterFile]
is used.
- (minus character)
Used to exclude (negate) a filter pattern that is specified on the command line when the filter
pattern option
[-p, --pattern]
is used.
+ (plus character)
Used to include (non-negate) a filter pattern that is specified on the command line when the
filter pattern option
[-p, --pattern]
is used.
The negation element, if present, is immediately followed by the path element.
Audit records that match a negated filter pattern are excluded from the
vlog
output. Specifically,
vlog
uses the following logic to include and exclude audit records from being output:
1. If there are no include (non-negated) filter patterns specified (either in the filter pattern
[-p, -
-pattern]
option or the filter file
[-F, --filterFile]
option), include all audit records in
the output.
2. If one or more filter patterns are specified:
a. If the audit record does not match any of the include (non-negated) filter patterns, do not
output the record.
b. If the audit record is not excluded by 2a above, and if the audit record matches any of the
exclude (negated) filter patterns, do not output the record.
Summary of Contents for OPEN ENTERPRISE SERVER 2 SP2 - STORAGE SERVICES AUDITING CLIENT LOGGER UTILITY REFERENCE 04-29-2010
Page 4: ...4 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 6: ...6 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 8: ...8 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 12: ...12 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
Page 32: ...32 OES 2 SP2 NSS Auditing Client Logger VLOG Utility Reference novdocx en 16 April 2010...
