Novell XDASV2 - ADMINISTRATION GUIDE V1, Руководство администратора

Страница: 24 / 40

24 Novell XDASv2 Administration Guide
n
ov
do
cx (e
n)
16
Ap
ril 20
10
A.4 Service or Application Management Events
This set of events relates to the management of services or applications. For example, the RPM
package manager might throw these events as packages are installed or removed from a Linux
system. Windows 32 Service Control Manager (SCM) events sent to the Windows 32 System Event
Log may be translated into these events as they are imported into OpenXDASv2. This set of events
could also be much more domain-specific, including concepts such as installing, removing, or
configuring installable executable-modules within a single application domain. The key idea is to
ensure that reported events have security significance.
Table A-4
Service or Application Management Event Taxonomy
Modify Data Item
Attribute 0.0.2.3 DSE_DEFINE
_ATTR_DEF
DSE_REMOV
E_ATTR_DEF
DSE_REMOV
E_CLASS_DE
F
DSE_DEFINE
_CLASS_DEF
DSE_MODIFY
_CLASS_DEF
Modify data item
attributes This event is reported whenever a
security-relevant data item or
resource element is modified –
either the value, or an attribute of
the data item
Event Name
Event
Identifier Corresponding
eDir Event
Description Use
Install Service 0.0.3.0 DSE_CHANG
E_MODULE_
STATE Install a service or
application This event is reported when a
service or application is installed
Remove Service 0.0.3.1 DSE_CHANG
E_MODULE_
STATE Remove a service
or application This event is reported when a
service or application is removed.
Query Service
Configuration 0.0.3.2 Query the
configuration of a
service or
application This event is reported when service
or application configuration
information is requested.
Modify Service
Configuration 0.0.3.3 Modify
configuration of a
service or
application This event is reported when service
or application configuration
information is modified.
Disable Service 0.0.3.4 DSE_CLOSE_
BINDERY Disable a service
or application This event is reported when a
service, operation or function is
disabled.
Event Name
Event
Identifier Corresponding
eDir Event
Dexription Use