HP StorageWorks Clustered File System 3.2.1 Windows Storage Server Edition Administration Guide (February 2006)

Chapter 17: Other Cluster Maintenance 175
Audit Administrative Commands
HP Clustered File System provides an audit feature that can be used to
log administrative commands in the event log. The following types of
commands are audited:
• Login authenication for the HP Management Console and mx
commands
• Commands invoked via the HP Management Console
• mx commands, with the exception of status commands
The audit entry contains the IP address and port number of the client TCP
connection. It also includes the user name used to log into the
Management Console or invoke the mx command. Login authentications
are recorded as either “success” or “failure.” The results of the
Management Console and mx commands are not recorded.
The audit entries are global and appear in the event log on all servers.
The audit log feature can be enabled or disabled; by default, it is enabled.
To disable auditing on a particular server, you will need to edit the
registry. Locate the following key:
HKEY_LOCAL_MACHINE\SOFTWARE\Hewlett-Packard\HP Clustered
File System\mxservice\Started Processes\mxlogd
ProgramArguments
Set the key to -a to disable the audit feature.
Add Your Own Messages to the Event Log
You can use the mxlogger command to add your own messages to the HP
Clustered File System event log. For example, you may want to add
messages about the state of your applications. The mxlogger command
has this syntax:
mxlogger -e entity -l level -d <id> [-G|-L] log-text
The -e entity option specifies the type of message that you are adding.
entity can be
USER1, USER2, USER3, USER4, USER5, USER6, USER7, or USER8.
You will need to determine how you want to use these entities.