HP StorageWorks XP Audit Log reference guide: HP XP12000 Disk Array, HP XP10000 Disk Array, HP 200 Storage Virtualization System (5697-8004, March 2009)

Syslog information
file
Settings audit log fileLogin audit log fileCompon-
ent
Check Audit Log: Event
in the syslog audit log
file.
[Audit Log], Over
Threshold: File has
reached 50% of the
maximum number of
lines.
[Audit Log], Over
MaxLine: Size of file
has reached its
maximum number of
lines and data is being
overwritten.
Once the information stored in the audit log information file reaches its maximum
capacity, the starting line of the oldest data begins to be overwritten with the
starting line of the newest data (wrap around). When you reach 70% of this
threshold, the yellow Audit:Warning button displays on the XP Remote Web
Console main pane. You should download the audit log information file at or
before this threshold to prevent the old data from being overwritten. If an FTP
server is specified, the audit log information file will be transferred to the FTP
server when the information stored in the audit log information file reaches the
threshold. When the information stored in the audit log information file exceeds
the maximum, and data is being overwritten, the red Audit:Wraparound button
displays. The counter is reset when you download or transfer the audit log
information file.
NOTE:
Do not use the transfer to the FTP server in combination with the manual
download. The line counter will reset if the audit log information file is
downloaded manually while the transfer to the FTP server is specified, and
some information may not be transferred to the FTP server. Therefore,
download the file manually only when the transfer to the FTP server is
disabled due to a failure of the FTP server and other reasons.
Threshold
The first line of the audit log file is the control information, including the file name and the last time the file
was written.
Control
Informa-
tion
Audit log file output
The following table describes the operation name and event name being output, depending on the
status of the audit log file (login information, setting information, and syslog information file
components). The event name will be automatically output only once, by the trigger described in the
Output trigger in the following table.
Table 2 Function names and event names output when audit log file is reproduced
Output triggerEvent nameFunction name
Output when abnormal files in the Audit log (login informa-
tion, setting information, and syslog information file compon-
ents) is reproduced automatically.
Create FileAuditLog
NOTE:
The event name Create File will be output only for the files which has been reproduced.
See “Create File” on page 53 for the example of the output for the function name and the event name
described in Table 2.
Introduction30