XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 56 Proprietary and Confidential
Suppressing Alerts on Historical Events
If you do not want to generate alerts on old audit events, use the MAXRECORDAGE
keyword to suppress alerts on events older than a selected age. All events will still be
written to the XMA database, unless the ACTIONTYPE = IGNORE.
The MAXRECORDAGE keyword lets you eliminate alerts for events that are too old to
matter anymore. This keyword generally only comes into play when a MOVER has
been stopped for some reason and is now adding historical data to the XMA database.
For example, if a record indicates that a user logged directly on as SUPER.SUPER,
but it happened last week, you probably do not want to be notified. In this situation, it
makes more sense to run reports to show these events.
Omitting this parameter would cause ALERTS and/or ACTIONS to occur for any
eligible record no matter how long ago the activity took place.
Syntax:
MAXRECORDAGE <seconds>
Example:
MAXRECORDAGE 3600
The Example above would only create an ALERT or perform an ACTION if the activity
identified is less than or equal to 1 hour old (60 minutes x 60 secs/minute).
Using Data Substitution Tokens
Some of the ACTIONTYPE keywords that accept text strings allow the information
from the XMA tables to be included in the message. The instances where data
substitution tokens may be used are indicated with the affected keywords. There are
two ways to specify data substitution tokens.
Option 1:
|(<table>.<column name>)|
Example 1
|(AUDIT.RECORDLCT)|
The example above selects the entire contents of the column RECORDLCT from the
Audit Detail Table. It would display as:
2012-10-24:23:00:01.158524