XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 6. Configuring MOVERs
XYPRO Technology Corporation 110 Proprietary and Confidential
Though Collect-Only MOVERs do not generate alerts, audit events will still be checked
against the FILTERS file and any record that would have generated an alert will be
marked with a “C” in the alerted column. A value of “C” means “identified as an alert by
a Collect-Only Serverclass.”
The HKEEPER Serverclass is responsible for waking up the Collect-Only MOVERs. It
considers the time window to be LCT on the master node. Remote Collect-Only
servers are also wakes up and shut down based on the LCT on the master node.
Note: If you want to have a Collect-Only Serverclass run outside of the “collection
window,” a parameter can be set to have this Serverclass omitted from the
automatic start-up and shut-down process.
Collect-Only MOVER Interaction with Audit Trail Files and HKEEPER
All MOVERs work the same way when reviewing audit trail files. A Collect-Only
MOVER will be started and stopped by HKEEPER if so configured. How it reads the
audit trail files is the same as any other MOVER. A Collect-Only MOVER is also not
used for alerting, only for recording events to the XMA audit tables.
A MOVER closes the audit trail it is processing when two conditions are met: the
MOVER has reached the EOF, and there are no write openers with the following
outcomes.
• If a MOVER reaches the EOF and there are write openers, the MOVER keeps
trying to read records and checking for write openers.
• If a MOVER reaches the EOF, and there are no write openers, it closes its own
read opener. At this point, it checks (using the states table) if there are any audit
trail files it needs to look at with the following outcomes:
1. If there are audit trail files that have records it needs to review, the cycle begins
again.
2. If there are no audit trail files to review, the MOVER goes to “sleep.” The
MOVER “wakes-up” every 1 to 3 minutes. This 1-to-3-minute behavior is
programmatic, using random numbers with system resources in mind. The
purpose is to keep from having multiple MOVERs “wake-up” at the same time.
6.1.3 Regular (Combined Alert and Collect)
Regular refers to Serverclasses that both generate alerts and update the database.
Most likely, all the MOVERs on the master node will be configured to do both because
the issue of EXPAND traffic is not relevant.
If you cannot reconfigure the Safeguard audit trail on your remote nodes to ensure that
all Safeguard activity is retained until the Collector Serverclasses are “woken up” to
update the XMA database, then the Safeguard MOVERs should probably also both
generate alerts and update the database in real time. Refer to the HP Safeguard
manuals for instructions on increasing the MAXFILES, EXTENTSIZE, and
MAXENTENTS for Safeguard Audit Pools.