eTrust Audit Reference Guide - CA Technologies

Recorder Configuration File
unicenter
The unicenter action tells the Action Manager to send events to the local
Unicenter agent (installed on the eTrust Audit host that performs the action)
for forwarding to the Unicenter Event Management Console on the specified
host as shown in the following example:
Action unicenter; systema
In the example, the Action Manager sends events to the Unicenter Event
Management Console on systema.
Note: Status codes from eTrust Access Control are translated to their generic
equivalents. In the Unicenter Event Management Console, events display
color codes and status icons. The Unicenter Event Management Agent must
be installed on the host where the Action Manager runs.
Recorder Configuration File
The recorder configuration file, each line (other than comment lines) provides
criteria for bringing audit records into the local audit file from Windows. A
record is admitted and handled by eTrust Audit if it matches the criteria of any
line in the file. If the record does not match a line, then eTrust Audit will ignore
the record. The file is selogrec.cfg in the audit\etc directory, where audit is the
directory in which you installed eTrust Audit. This file defines which NT logs
will be read, according to the client.
The format is explained in the following example. Use commas as delimiters
within the three-part resource specification, (source, event category, event ID),
This is different that the semicolons that are used as delimiters elsewhere. The
file is case-sensitive.
You can select the way to filter the events that are recorded by using the
following mask:
;;;
For example:
NT-Security;Security,Detailed Tracking,593;jerry;S
The default values, which can be selected during installation, are:
■
■
■
NT-System;*;*;*
NT-Security;*;*;*
NT-Application;*;*;*
4–6 Reference Guide