OSF DCE Administration Guide--Core Components

OSF DCE Administration Guide—Core Components
43.8.1 Displaying Audit Trail Files
Use the dcecp auditrail show command to examine the contents of an audit trail file.
You can display the contents of either the central or local audit trail file.
For example, you can use the following command to see the contents of the audit trail file
central_trail:
dcecp> audtrail show /opt/dcelocal/var/audit/adm/central_trail
--- Start of an event record --- Event Number: 259
Client: /.../stp.gburg.ibm.com/hosts/drinkernisti/self
Event Outcome: success
Authorization Status: Authorized with a pac
Local Time: 1994-12-19-19:02:27.037-05:00I-----
--- End of an event record ---
--- Start of an event record --- Event Number: 256
Client: /.../stp.gburg.ibm.com/hosts/drinkernisti/self
Event Outcome: success
Authorization Status: Authorized with a pac
Local Time: 1994-12-19-19:02:28.819-05:00I-----
--- End of an event record ---
If you prefer to have the audit trail data put into a file instead of displayed on your
screen, include the -to option in the audtrail show command line. This option prints the
audit trail file’s contents to a specified filename. Using this option is strongly
recommended for large trail files.
43.8.2 Controlling the Audit Trail Size
By default, audit trail files are limited to a size of 2 MB. When the audit service detects
that the trail file will grow larger than this value, it closes the file, creates a new unique
name for the file by using timestamp information, and then opens a new trail file with the
original name. It then proceeds to write new audit logs to this file. When this file grows
too large, this process is repeated.
If you wish to change the size of the audit trail file, you must set the environment
variable DCEAUDITTRAILSIZE to the size you require before starting the application
that is using the audit service. Setting this environment variable overrides the default 2
MB size limit.
For example, if you wish to use a trail file size of 5 MB, the value of
DCEAUDITTRAILSIZE should be as follows:
DCEAUDITTRAILSIZE 5000000
43 − 10 Tandem Computers Incorporated 124243