Difference between revisions of "HowTos/Using the Audit logging"
(TB/TB-2009-05-AUDIT-LOGGING) |
|||
| Line 14: | Line 14: | ||
| − | ~openmail/sys/audit.cfg | + | ''~openmail/sys/audit.cfg'' |
| Line 23: | Line 23: | ||
| − | • omshowaud - to show the current settings | + | • ''omshowaud'' - to show the current settings |
| − | • omconfaud - to configure the settings | + | • ''omconfaud'' - to configure the settings |
You can enable Audit logging on the various parts of OpenMail. To see the complete list, | You can enable Audit logging on the various parts of OpenMail. To see the complete list, | ||
| − | simply issue an omshowaud: | + | simply issue an ''omshowaud:'' |
| − | $ omshowaud | + | ''$ omshowaud'' |
Service Router 0 | Service Router 0 | ||
| Line 61: | Line 61: | ||
| − | By default, everything is turned off! To see what information you get at the various levels you must look at the audit.cfg file. | + | By default, everything is turned off! To see what information you get at the various levels you must look at the ''audit.cfg'' file. |
| − | audit.cfg | + | '''audit.cfg''' |
| − | + | ||
| − | The entries in this file are grouped for each part of Scalix that knows about Audit logging. The first trick is working out the mapping between the part number within this audit.cfg file and the part name as specified in the omconfaud command. The section commented as service router is pretty obvious, but how can you tell which sections relate to Remote Client Interface? When you look in the audit.cfg file you do not see any section called Remote Client Interface...you see sections called user-signon and user-signoff. Indeed this had confused people for so long that in B.04 we added an extra file audit.map which shows these mappings. | + | The entries in this file are grouped for each part of Scalix that knows about Audit logging. The first trick is working out the mapping between the part number within this ''audit.cfg'' file and the part name as specified in the ''omconfaud'' command. The section commented as ''service router'' is pretty obvious, but how can you tell which sections relate to ''Remote Client Interface''? When you look in the ''audit.cfg'' file you do not see any section called ''Remote Client Interface''...you see sections called ''user-signon'' and ''user-signoff''. Indeed this had confused people for so long that in B.04 we added an extra file ''audit.map'' which shows these mappings. |
It looks something like this: | It looks something like this: | ||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
| − | |||
Revision as of 15:17, 19 May 2009
Introduction
Audit level logging was originally implemented so that Scalix administrators could extract accounting information. They could determine how often people were logging on, for how long, etc., in order to bill for connection time. The actual output of the Audit logs is pretty basic, but there are already a number of people who have written scripts to take this output and produce PC-format files that can be fed into graphics packages to produce lovely statistics of message pass-through rates etc..
Although originally written with accounting in mind, Audit logging should not be overlooked as a debugging/troubleshooting tool. Indeed, you should consider using Audit logging as your first mechanism when trying to see what’s happening on the system.
Overview
The whole audit logging setup is configured through the file:
~openmail/sys/audit.cfg
In this file, you specify what activities are logged and for what Audit level they are logged.
The commands for setting up Audit level logging are:
• omshowaud - to show the current settings
• omconfaud - to configure the settings
You can enable Audit logging on the various parts of OpenMail. To see the complete list,
simply issue an omshowaud:
$ omshowaud
Service Router 0
Local Delivery 0
Internet Mail Gateway 0
Local Client Interface 0
Remote Client Interface 0
Administration 0
Request Server 0
Directory Synchronization 0
Bulletin Board Server 0
Lotus Notes Interface 0
SMS Gateway 0
Background Search Service 0
By default, everything is turned off! To see what information you get at the various levels you must look at the audit.cfg file.
audit.cfg
The entries in this file are grouped for each part of Scalix that knows about Audit logging. The first trick is working out the mapping between the part number within this audit.cfg file and the part name as specified in the omconfaud command. The section commented as service router is pretty obvious, but how can you tell which sections relate to Remote Client Interface? When you look in the audit.cfg file you do not see any section called Remote Client Interface...you see sections called user-signon and user-signoff. Indeed this had confused people for so long that in B.04 we added an extra file audit.map which shows these mappings.
It looks something like this:
