IBM Tivoli Access Manager for e-business: WebSEAL Administration ...

Maximum
size,
in
bytes,
of
event
buffer
in
memory
to
be
built
from
individual
events.
v
Specify
file
mode
Binary
or
text.
Text
mode
is
available
for
Windows
platform
only.
The
optional
configuration
tasks
are
supported
by
Tivoli
Access
Manager
event
logging
but
not
by
legacy
auditing.
For
more
information
on
these
tasks,
see
IBM
Tivoli
Access
Manager
Base
Administration
Guide.
Example
configuration
The
syntax
for
using
logcfg
to
configure
an
audit
trail
file
is:
logcfg
=category:file
path=file_pathname,
flush_interval=seconds,\
rollover_size=number,
log_id=logid,
queue_size=number,
hi_water=number,
buffer_size=number,
mode={text|binary}
Supported
values
for
category
are:
Table
15.
Audit
event
categories
Audit
event
type
Category
setting
Credentials
acquisition
authentication
audit.authn
Authorization
audit.azn
HTTP
logging
information
http
HTTP
request
information
in
common
log
format
http.clf
HTTP
Referer
header
information
http.ref
HTTP
User
Agent
header
information
http.agent
The
NCSA
combined
format
captures
HTTP
request
information
(with
time
stamp)
and
appends
the
quoted
referer
and
agent
strings
to
the
standard
common
log
format.
http.cof
For
example,
the
following
logcfg
entry
creates
a
WebSEAL
audit
trail
file
that
collects
authentication
events:
logcfg
=
audit.authn:file
path=/var/pdweb/log/audit.log,flush_interval=20,
\
rollover_size=2000000
Note:
The
above
example
is
entered
as
one
continuous
line
in
the
WebSEAL
configuration
file.
In
this
example,
auditing
is
enabled
when
Tivoli
Access
Manager
reads
the
logcfg
entry
at
startup
time.
The
required
configuration
settings
are
provided
by
the
following
parameters:
Table
16.
Example
values
for
required
configuration
settings
Parameter
Required
setting
audit.authn:file
Type
of
audit
event
path=/var/pdweb/log/audit.log
Audit
file
location
rollover_size=2000000
Audit
file
size
flush_interval=20
File
flush
interval
Chapter
4.
Serviceability
and
logging
99