Novell OPEN ENTERPRISE SERVER 2 SP2 - STORAGE SERVICES AUDITING CLIENT LOGGER UTILITY REFERENCE 04-29-2010, Reference

Page: 29 / 32

VLOG Utility Man Page 29
n
ov
do
cx (e
n)
16
Ap
ril 20
10
VOL1:/abc/* (* !OPEN(NSS) !CLOSE(NSS))
Include: Matches all events except the NSS
OPEN
and NSS
CLOSE
events on any file in the
VOL1:/abc
directory.
VOL1:/abc/* (* !OPEN(* !NSS) !CLOSE(* !NSS))
Include: Matches all events except the non-NSS
OPEN
and non-NSS
CLOSE
events on any file in
the
VOL1:/abc
directory.
!VOL1:/abc/def (*)
Exclude: Matches all events for the
VOL1:/abc/def
file. This exclusion causes all events on
the
VOL1:/abc/def
file to be dropped (assuming that they had been included by an include
rule).
!VOL1:/abc/def (OPEN)
Exclude: Matches
OPEN
events for the
VOL1:/abc/def
file. This exclusion effectively
excludes
OPEN
events on the
VOL1:/abc/def
file.
VOL1:/abc/def (* !OPEN)
Include: Matches all events except the
OPEN
event on the
VOL1:/abc/def
file. This is another
way to exclude
OPEN
events on the
VOL1:/abc/def
file.
!VOL1:/abc/def (* !OPEN)
Exclude: Matches all events except the
OPEN
event on the
VOL1:/abc/def
file. This
effectively excludes all events except the
OPEN
event on the
VOL1:/abc/def file
(assuming
they had been included by an include rule).
"VOL1:/xyz dir/*" (*)
Include: Matches all events on any file in the “
VOL1:/xyz dir
” directory. Quotation marks are
used to enclose the pattern when the path contains spaces. Otherwise, the space in “
xyz dir
” is
treated as a delimiter between the pattern and the events.
VOL1:/xyz\ dir/* (*)
Include: Matches all events on any file in the “
VOL1:/xyz dir
”. A backslash (
\
) is used to
escape the space character in the directory name “
xyz dir
”. Otherwise, the space in “
xyz
dir
” is treated as a delimiter between the pattern and the operations.
Troubleshooting
Orphaned Auditing Client
The NSS Auditing Engine (
vigil
) implements an interface that allows user-space applications
(such as
vlog
) to establish Auditing Clients. When doing so, the user-space application (such as
vlog
) specifies various parameters, such as a directory in the Linux file system where the auditing
record log files are placed.
After an Auditing Client has been established, the NSS Auditing Engine (
vigil
) architecture has
been designed to store the auditing records in files in the directory specified by the auditing
application (such as
vlog
or Novell Sentinel).