Use the Event Log object to create, configure, disable and enable system and subsystem level log files to capture system, security, debug, packet, trace and accounting events.

Event Types

EventFacility
System16local0
Debug17local1
Trace18local2
Security19local3
Audit20local4
Accounting22local6
Platform Audit Logs23local7

Note

Facility 21 and local5 are used by /var/log/fips.log.

 

For each event type, an event class (subsystem) and severity threshold can be configured. Event classes include:

  • Audit
  • Call processing
  • Directory services
  • Network management
  • Policy
  • Resource management
  • Network routing
  • Security
  • Signaling
  • System management
  • Call trace

The ROLLFILE facility provides a means of closing the active log file and opening a new one with an incremented (name) suffix. This facilitates real-time analysis of system events by performing the analysis on closed, rather than opened and growing, files.

For configuration details, see:

  • No labels