PDF user manual for CopperEdge 150

Audit LogWhen isolating the cause of a problem, it can be helpful to knowwhat might have triggered it. On systems with an SCM-2 orSCM-3, the CE150 software includes uploadable logfiles containinga record of the most recent attribute changes (up to1,000 events) on this CE150. Attribute changes are generallychanges that result from a Set command.With the time-stamped AttributeChange known, you can logicallyinfer the precipitating command. The Audit Log also liststhe name and IP address of the operator initiating the change,as well as the command context (such as Telnet or SNMP) andthe privilege level of the operator. The addition of this informationinvests the Audit Log with an implicit role in maintainingsystem security.The full audit log information base consists of four files storedin the Logs directory on the CE150 flash system (the P: (IDE)drive) of the SCM-2 and SCM-3:• audit.txt—The audit log that is currently filling; containsthe most recent AttibuteChange events.• audit_count.txt—This file contains a running count of theevents in the audit.txt file. When this number reaches500, new audit.txt and audit_count.txt files are createdand the old files are renamed.• audit.bak—The previous audit.txt file, now filled with the500 AttributeChange events immediately precedingthose in the current audit.txt file.• audit_count.bak—The previous audit_count.txt file, nowindicating the total number of records (500) in theaudit.bak file. When the next cycle is completed and thecurrent .txt files are filled and renamed, the current .bakfiles are overwritten.The audit log files are accessible only through FTP, and only byan operator with Security level privilege. Once uploaded, theraw files have the format of one record per line, with fields delimitedby a vertical bar (|), but this can be easily re-formattedusing a spread-sheet program.&KDSWHU7URXEOHVKRRWLQJ