XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Glossary
XYPRO Technology Corporation 312 Proprietary and Confidential
MAXACTIONRATE Filter Keyword
This keyword acts like an EMS throttle. It allows you to specify how often you want to
receive notification if the same situation occurs. All the activity will still be written to the
XMA database. This field only controls the number of alerts generated.
Omitting this parameter would cause ALERTS and/or ACTIONS to occur for any
eligible record no matter how often the activity is occurring.
Note: The information related to MAXACTIONRATE is stored in context within the
MOVER Serverclass object. Stopping and restarting a MOVER Serverclass may
generate extra messages. Altering the FILTERS file also resets the
MAXACTIONRATE counter.
Note: The MAXACTIONRATE is based on the number of “hits” on the same Filter, not
the actual contents of the event. For example, if you set the MAXACTIONRATE
for a short time period and then run an obey file to add several users in
SAFECOM, you may not be alerted for each ADD event. It is better to restrict
the records that generate Safeguard alerts by using the Safeguard selection
criteria such as MESSAGEID and MESSAGECODE. Refer to Chapter 7,
“Safeguard Selection Criteria” starting on page 135 for more information.
Syntax:
MAXACTIONRATE <seconds>
Example:
MAXACTIONRATE 300
The Example above would only create an ALERT if the same Filter has not been used
to generate an event in the past 5 minutes (5 minutes x 60 secs/minute).
MAXRECORDAGE Filter Keyword
The MAXRECORDAGE keyword lets you eliminate alerts for events that are too old to
matter anymore. Generally, this keyword only comes into play when a MOVER has
been stopped for some reason and is now adding historical data to the XMA database.
For example, if a record indicates that a user logged on directly as SUPER.SUPER but
it happened last week, then you probably do not want to be notified. In this situation, it
makes more sense to run reports to show these events.
Omitting this parameter would cause ALERTS and/or ACTIONS to occur for any
eligible record no matter how long ago the activity took place.
Syntax:
MAXRECORDAGE <seconds>
Example:
MAXRECORDAGE 3600
The Example above would only create an ALERT or perform an ACTION if the activity
identified is less than or equal to 1 hour old (60 minutes x 60 secs/minute).