XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 54 Proprietary and Confidential
DATA_SELECT_BEGIN
FILTERTYPE STRINGFILTER
AUDIT.RULENAME = TACL-255
AUDIT.MESSAGEID = XAC-I
DATA_SELECT_END
If you want an alert for several XAC (but not all) commands, you have several options.
You could list them individually:
AUDIT.RULENAME LIKE "(TACL-255|SCF-255|EDIT-255)"
If you have good naming conventions for the command names, you might be able to
wildcard the names:
AUDIT.RULENAME CONTAINS "-255"
If what you really want is to be notified when anyone invokes any XAC command that
will execute as SUPER.SUPER, then you might choose to select on the
TARGETLOGIN or TARGET_USERNUMBER_MAJOR and
TARGET_USERNUMBER_MINOR columns:
AUDIT.TARGET_USERNUMBER_MAJOR = 255
AUDIT.TARGET_USERNUMBER_MINOR = 255
- or -
AUDIT.TARGETLOGIN = SUPER.SUPER
3.3.6 Step 6. Define the Filter’s Action
Once you have selected the audit events you are interested in, it is time to define the
action that you want XMA to take each time it captures the events. The ACTION
paragraphs tell the MOVERs what to do when an audit record meets the DATA
selection criteria. The ACTION taken is determined by the ACTIONTYPE keyword.
Syntax:
ACTIONTYPE = {actiontype}
The ACTIONTYPEs are:
ALERT Generate an EMS message
IGNORE Discard the record; do not write it to the XMA database
IPALERT Send the selected message to a SYSLOG
MAIL Send the selected message via email
RETAIN Implement selective Archive or Cleanup
RUNCMD Run the defined macro
SETDATA Put the defined string into the USER_DATA column of the XMA
database.
SNMPTRAP Send the selected message to an SNMPTRAP.
SYSLOGQ Send the message to the SYSLOGQ table.