5.2 Configuring the Platform Agent Text File

After you install Identity Manager, you can configure the Platform Agent. The Platform Agent’s configuration settings are stored in a simple, text-based logevent configuration file. By default, logevent file is located in the following directories:

Table 5-1 Platform Agent Configuration File

Operating System

File

Linux

/etc/logevent.conf

Solaris*

/etc/logevent.conf

Windows*

\windows\logevent.cfg

The following is a sample logevent.cfg file. 

LogHost=127.0.0.1
LogCacheDir=c:\logcache
LogCachePort=288
LogEnginePort=289
LogCacheUnload=no
LogReconnectInterval=600
LogDebug=never
LogSigned=always

The entries in the logevent file are not case sensitive, entries can appear in any order, empty lines are valid, and any line that starts with a hash (#) is commented out.

You must add the following entry into the logevent.cfg file to log events for the User Application:

LogJavaClassPath=/opt/novell/idm/NAuditPA.jar

The User Application installation copies this file into the correct directory, but the entry must be manually added to the logevent.cfg.

The following table provides an explanation of each setting in the logevent file. The Platform Agent is used by Sentinel and Novell Audit. The documentation for the Platform Agent is in the Novell Audit 2.0 Administration Guide.

IMPORTANT:You must restart the Platform Agent any time you make a change to the configuration.

Table 5-2 logevent Settings

Setting

Description

LogHost=dns_name

The hostname or IP address of the Event Source Server where the Platform Agent sends events.

In an environment where the Platform Agent connects to multiple hosts—for example, to provide load balancing or system redundancy—separate the IP address of each server with commas in the LogHost entry. For example, 

LogHost=192.168.0.1,192.168.0.3,192.168.0.4

The Platform Agent connects to the servers in the order specified. If the first logging server goes down, the Platform Agent tries to connect to the second logging server, and so on.

LogCacheDir=path

The directory where the Platform Agent stores the cached event information if the Event Source Server becomes unavailable.

LogEnginePort=port

The port at which the Platform Agent can connect to the Event Source Server. By default, this is port 289.

LogCachePort=port

The port at which the Platform Agent connects to the Logging Cache Module.

If the connection between the Platform Agent and the Event Source Server fails, Identity Manager continues to log events to the local Platform Agent. The Platform Agent simply switches into Disconnected Cache mode; that is, it begins sending events to the Logging Cache module (lcache). The Logging Cache module writes the events to the Disconnected Mode Cache until the connection is restored.

When the connection to the Event Source Server is restored, the Logging Cache Module transmits the cache files to the Event Source Server. To protect the integrity of the data store, the Event Source Server validates the authentication credentials in each cache file before logging its events.

LogCacheUnload=Y|N

Set the parameter to N to prevent lcache from being unloaded.

LogCacheSecure=Y|N

Set the parameter to Y to encrypt the local cache file.

LogReconnectInterval=seconds

The interval, in seconds, at which the Platform Agent and the Platform Agent Cache try to reconnect to the Event Source Server if the connection is lost.

LogDebug=Never|Always

The Platform Agent debug setting.

  • Set to Never to never log debug events.

  • Set to Always to always log debug events.

LogSigned=Never|Always

The signature setting for Platform Agent events.

IMPORTANT:Sentinel can receive and map Audit signatures to a Novell Sentinel event field; however, Novell Sentinel does not currently verify event signatures.

  • Set to Never to never sign or chain events.

  • Set to Always to always log events with a digital signature and to sequentially chain events.

LogMaxBigData=bytes

The maximum size of the event data field. The default value is 3072 bytes. Set this value to the maximum number of bytes the client allows. Data that exceeds the maximum is truncated or not sent if the application doesn’t allow truncated events to be logged.

LogMaxCacheSize=bytes

The maximum size, in bytes, of the Platform Agent cache file.

LogCacheLimitAction=stop logging|drop cache

The action that you want the cache module to take when it reaches the maximum cache size limit.

  • Set to stop logging if you want to stop collecting new events.

  • Set to drop cache if you want to delete the cache and start over with any new events that are generated.

LogJavaClassPath

The location of the NAuditPA.jar lcache file. For example:

LogJavaClassPath=/opt/novell/idm/NAuditPA.jar

Proceed to Section 6.0, Securing the Logging System.