Event and Accounting Logs
246
System Management Guide
3HE 11018 AAAC TQZZA Edition: 01
5.3.3 Log Manager and Event Logs
Events that are forwarded by event control are sent to the log manager. The log
manager manages the event logs in the system and the relationships between the
log sources, event logs and log destinations, and log filter policies.
An event log has the following properties:
• a unique log ID
The log ID is a short, numeric identifier for the event log. A maximum of 10 logs
can be configured at a time.
• one or more log sources
The source stream or streams to be sent to log destinations can be specified.
The source must be identified before the destination can be specified. The
events can be from the main event stream, events in the security event stream,
or events in the user activity stream.
• one event log destination
A log can only have a single destination. The destination for the log ID
destination can be one of console, session, syslog, snmp-trap-group, memory,
or a file on the local file system.
• an optional event filter policy
An event filter policy defines whether to forward or drop an event or trap based
on match criteria.
5.3.4 Event Filter Policies
The log manager uses event filter policies to control which events are forwarded or
dropped based on various criteria. Like other policies with the 7705 SAR, filter
policies have a default action. The default actions are either:
•forward
•drop
Filter policies also include a number of filter policy entries that are identified with an
entry ID and define specific match criteria and a forward or drop action for the match
criteria.
Each entry contains a combination of matching criteria that define the application,
event number, router, severity, and subject conditions. The entry’s action determines
how the packets should be treated if they have met the match criteria.
To Next Page
Loading...
