Difference between revisions of "HowTos/Using the Audit logging"

Revision as of 15:21, 19 May 2009

Introduction

Audit level logging was originally implemented so that Scalix administrators could extract accounting information. They could determine how often people were logging on, for how long, etc., in order to bill for connection time. The actual output of the Audit logs is pretty basic, but there are already a number of people who have written scripts to take this output and produce PC-format files that can be fed into graphics packages to produce lovely statistics of message pass-through rates etc..

Although originally written with accounting in mind, Audit logging should not be overlooked as a debugging/troubleshooting tool. Indeed, you should consider using Audit logging as your first mechanism when trying to see what’s happening on the system.

Overview

The whole audit logging setup is configured through the file:

/var/opt/scalix/*/s/sys/audit.cfg

In this file, you specify what activities are logged and for what Audit level they are logged.

The commands for setting up Audit level logging are:

• omshowaud - to show the current settings

• omconfaud - to configure the settings

You can enable Audit logging on the various parts of OpenMail. To see the complete list,

simply issue an omshowaud:

$ omshowaud

Service Router 0

Local Delivery 0

Internet Mail Gateway 0

Local Client Interface 0

Remote Client Interface 0

Administration 0

Request Server 0

Directory Synchronization 0

Bulletin Board Server 0

Lotus Notes Interface 0

SMS Gateway 0

Background Search Service 0

By default, everything is turned off! To see what information you get at the various levels you must look at the audit.cfg file.

audit.cfg

The entries in this file are grouped for each part of Scalix that knows about Audit logging. The first trick is working out the mapping between the part number within this audit.cfg file and the part name as specified in the omconfaud command. The section commented as service router is pretty obvious, but how can you tell which sections relate to Remote Client Interface? When you look in the audit.cfg file you do not see any section called Remote Client Interface...you see sections called user-signon and user-signoff. Indeed this had confused people for so long that in B.04 we added an extra file audit.map which shows these mappings.

It looks something like this: