XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 6. Configuring MOVERs
XYPRO Technology Corporation 125 Proprietary and Confidential
The security-related BASE24 EMS messages have "ACI.XPSNCP" as the first part of
the SSID. The SSID is placed in the AUDIT.OBJECTNAME column. You can use this
to select security-related BASE24 events in Filters and reports.
To capture the initialization of BASE24 audit logs, you should also look for EMS events
with an SSID of "ACI.LOGDATER" to capture the audit log initialization messages.
This is a PCI requirement.
6.6 HLR MOVERs
The Home Location Register (HLR) is the main database of permanent subscriber
information for a mobile network. HLR contains pertinent user information, including
address, account status, and preferences. The HLR interacts with the Mobile
Switching Center (MSC), which is a switch used for call control and processing.
Changes to this database are made using the DPA application, which sends audit
information to EMS and/or log files, depending on application configuration.
XYGATEMA gathers HLR data, only from the log files. These audit trails reside in the
OSS environment on the NonStop server. The log files are generally named
dpa_audit_<start date/time>_<close date/time>.log. Customers can place
these logs in any directory.
The HLR application makes it possible to have multiple environments, identified by
within the application by a Node ID (multiple-HLR Node IDs can reside on a single
NonStop server). The Node ID is generally part of the directory name where the audit
logs reside.
To capture HLR data in XYGATEMA, you must create HLR MOVERs for each
directory where DPA audit logs reside, and therefore, per Node ID. You cannot add
HLR MOVERs using Discover. You must add them manually, using the Movers
Management Menu, option 7: Add <All Steps> (page 101).
1: Node :\N1
2: HLR Application Node ID :NODEG
3: HLR audit file mask :
1: Node
This is the HP NonStop server node name.
2: HLR Application Node ID
This is the HLR application Node ID. The Node ID is required
and must be entered in uppercase letters, just as it appears in
the pathname for the HLR audit logs.
3: HLR audit file mask
This is the full OSS path and wildcarded file mask of the HLR
audit logs. This field is case sensitive and must exactly match
the actual directory location and filemask of the audit logs.
Syntax: /<full path>/<NODEID>/dpa_audit_*
Example: /users/hlr/PS4JQ/dpa_audit_*