HowTos/Using the Audit logging

From Scalix Wiki
Revision as of 15:51, 19 May 2009 by Greg (Talk | contribs)

Jump to: navigation, search


Audit level logging was originally implemented so that Scalix administrators could extract accounting information. They could determine how often people were logging on, for how long, etc., in order to bill for connection time. The actual output of the Audit logs is pretty basic, but there are already a number of people who have written scripts to take this output and produce PC-format files that can be fed into graphics packages to produce lovely statistics of message pass-through rates etc..

Although originally written with accounting in mind, Audit logging should not be overlooked as a debugging/troubleshooting tool. Indeed, you should consider using Audit logging as your first mechanism when trying to see what’s happening on the system.


The whole audit logging setup is configured through the file:


In this file, you specify what activities are logged and for what Audit level they are logged.

The commands for setting up Audit level logging are:

omshowaud - to show the current settings

omconfaud - to configure the settings

You can enable Audit logging on the various parts of Scalix. To see the complete list,

simply issue an omshowaud:

$ omshowaud

Service Router 0

Local Delivery 0

Internet Mail Gateway 0

Local Client Interface 0

Remote Client Interface 0

Administration 0

Request Server 0

Directory Synchronization 0

Bulletin Board Server 0

Lotus Notes Interface 0

SMS Gateway 0

Background Search Service 0

By default, everything is turned off! To see what information you get at the various levels you must look at the audit.cfg file.


The entries in this file are grouped for each part of Scalix that knows about Audit logging.

The first trick is working out the mapping between the part number within this audit.cfg file and the part name as specified in the omconfaud command.

The section commented as service router is pretty obvious, but how can you tell which sections relate to Remote Client Interface? When you look in the audit.cfg file you do not see any section called Remote Client see sections called user-signon and user-signoff. Indeed this had confused people for so long that in B.04 we added an extra file which shows these mappings.

It looks something like this:

   '$ cat ~scalix/*/s/sys/
    # This file maps entries in ~/sys/audit.cfg (1st col) to services (2nd
    1       2       # ’routing’ to Service Router
    2       11      # ’omscan’ to Administration
    3       8       # ’user-signon’ to Local Client Interface
    3       9       # ’user-signon’ to Remote Client Interface
    4       8       # ’user-signoff’ to Local Client Interface
    4       9       # ’user-signoff’ to Remote Client Interface
    4       25      # ’user-signoff’ to P7 Client Interface
    5       11      # ’subsystem-start’ to Administration
    6       11      # ’subsystem-stop’ to Administration
    7       16      # ’fax’ to Fax Gateway
    8       3       # ’delivery’ to Local Delivery
    9       18      # ’request’ to Request Server
    10      4       # ’unix-in’ to Unix Mail Gateway
    11      4       # ’unix-out’ to Unix Mail Gateway
    12      6       # ’desk-in’ to HPDesk Gateway
    13      6       # ’desk-out’ to HPDesk Gateway
    14      5       # ’x400-in’ to X400 Interface
    15      5       # ’x400-out’ to X400 Interface
    16      24      # ’dirsync-in’ to Directory Synchronization
    17      24      # ’dirsync-out’ to Directory Synchronization
    18      26      # ’bulletin’ to Bulletin Board Server
    19      29      # ’sms-out’ to SMS Gateway
    20      29      # ’sms-in’ to SMS Gateway'

The next trick is to understand what parts of the audit.cfg file you can change and what parts are fixed:

The file format is as follows:

      # service router   <-----------------   Descriptive comment
      %    1 routing                        ~/logs/audit   <--------   output file name
      1   time                            1
      2   type                            5
      3   ua-message-id                   1
      4   ua-ack-id                       3   <--------  The audit level that produces this output
      The four in front of ua-ack-id is The Unique ID
      ua-ack-id= Text to be output