XYGATE Merged Audit Reference Manual

XYGATE Merged Audit
®
Reference Manual
Chapter 3. Configuring Filters and the FILTERS File
XYPRO Technology Corporation 63 Proprietary and Confidential
RETAIN_DAYS The number of days that audit records matching the Filter’s
selection criteria will be retained in the XMA database
before being removed by either ARCHIVE or CLEANUP.
Enter day(s) as a number between 1 and 5500 (15 years )
or –1, which means “never remove.”
RETAIN_MONTHS The number of months that audit records matching the
Filter’s selection criteria will be retained in the XMA
database before being removed by either ARCHIVE or
CLEANUP.
Enter the month(s) as a number between 1 and 180
(15 years) or –1, which means “never remove.”
You cannot add any other MOVER paragraphs to a Filter with
PRODUCT = FILEMAINT.
Important! The RETAIN_DAYS and RETAIN_MONTHS keywords are mutually
exclusive. You can only use one or the other, not both in the same Filter.
Example 4 shows the ACTION configuration for selecting archive and cleanup.
Because the RETAIN_DAYS is set to –1, data records that match the Filter’s selection
criteria will never be deleted from the XMA database.
Example 4: Sample ACTION paragraph for selecting archive and cleanup
ACTION_BEGIN
ACTIONTYPE RETAIN
RETAIN_DAYS -1
ACTION_END
Configuring RUNCMD Actions
Use the RUNCMD action to kick off TACL commands or TACL macros when an audit
event matching the DATA selection criteria occurs. For example, you might want to
have XMA automatically run a macro that would thaw SUPER.SUPER or SEC.ADMIN
if it were frozen due to wrong passwords. Or you might want to kick off a script that
would automatically create and secure the appropriate INITIAL DIRECTORY when a
new OSS user is added.
The MOVER’s parsing routine will accept multiple TACL commands within the
“paragraph” between RUNCMDDEFBEGIN and RUNCMDDEFEND. There is no limit
to the number of commands other than exhausting memory. The commands will be
concatenated together in a comma-separated list.
If you want to execute more than four or five commands, it would be best to create a
TACL macro. The Macro can be then be executed by a single RUNCMD entry.