294 • Monitoring and Auditing HP NonStop SSH Reference Manual
Viewing File Contents from Guardian with
SHOWLOG
SSH2 servers may be configured to write log or audit files to disk. For performance reasons, those log files are created as
unstructured files:
15> fileinfo SSH2log
$data1.comfSSH2
CODE EOF LAST MODIFIED OWNER RWEP PExt Sext
SSH2log 0 5044 25sep2003 15:14 110,111 aaaa 4 28
16>
While the program is running, the log file is always open, however it may be concurrently opened for viewing. To
convert the unstructured file into a readable format, a tool SHOWLOG is supplied. Invoking SHOWLOG without
arguments will display a brief syntax summary:
20> run showlog
SHOWLOG log file converter Version T9999A06_15Nov2012_HP_SHOWLOG_0024
usage: SHOWLOG <log-file> [<out-file> [<start> [<end>]]]
<log-file> | the input log file to be converted
<out-file> | file to write to, default is '*' meaning the home terminal
<start> | either byte offset from beginning or a timestamp
<end> | either number of bytes after beginning or a timestamp
-- Supported timestamp formats: --
"ddmmmyy HH:MM:SS.TTT", "ddmmmyy HH:MM:SS.TT", "ddmmmyy HH:MM:SS",
"ddmmmyy HH:MM", "ddmmmyy", "HH:MM:SS.TTT", "HH:MM:SS.TT", "HH:MM:SS",
"HH:MM".
Current date is used if date not specified as part of <start> timestamp.
Date from <start> is used if date not specified in <end> timestamp.
-- Examples --
Whole log file written to home terminal:
SHOWLOG logfile
Display 1000 bytes starting at offset 10000 written to EDIT file logedit
SHOWLOG logfile logedit 10000 1000
Starting at offset 200000 and display all bytes up to the end of the file
SHOWLOG logfile * 200000
Display messages in timeframe to home terminal
SHOWLOG logfile * "03Jan11 03:15" "05Jan07 21:30:10.89"
Write messages in timeframe to EDIT file logedit starting from specified time
SHOWLOG logfile logedit "01Feb12 01:02:03.67"
21>
If SHOWLOG is run with only the name of the log file as first runtime argument, it will dump the whole log file to the
home terminal. The byte offset within the log file will be displayed every now and then; this allows you to limit the
output of SHOWLOG to certain sections of the log file as shown below.
$US SSH92 33> run showlog sh54log
SHOWLOG log file converter Version T9999A05_16Apr2009_HP_SHOWLOG_0022
---processing in-file 'sh54log'
$SSH54|18Apr12 17:07:30.97|20|--------------------------------------------------------
--------
$SSH54|18Apr12 17:07:31.00|10|SSH2 version T9999H06_17Apr2012_comForte_SSH2_0092
$SSH54|18Apr12 17:07:31.02|10|config file: '(none)'
$SSH54|18Apr12 17:07:31.03|20|object filename is '\NPNS01.$US.SSH92.SSH2'
$SSH54|18Apr12 17:07:31.04|20|object subvolume is '\NPNS01.$US.SSH92', priority is 11
$SSH54|18Apr12 17:07:31.06|20|dumping configuration:
[def ] ALLOWEDAUTHENTICATIONS <keyboard-interactive,password,publickey>
[par ] ALLOWEDSUBSYSTEMS <sftp,tacl>
[par ] ALLOWFROZENSYSTEMUSER <TRUE>
[def ] ALLOWINFOSSH2 <ALL>
[def ] ALLOWPASSWORDSTORE <TRUE>
[run ] ALLOWTCPFORWARDING <true>
[par ] AUDITCONSOLE <%;>
[run ] AUDITFILE <SH54AUD>
[def ] AUDITFILERETENTION <10>
To Next Page
Loading...
Need help?
General