HP StorageWorks XP24000/XP20000 Audit Log Reference Guide (AE131-96085, May 2011)

Table 1 Audit Log File Components (continued)
Syslog Information FileAudit Log Information FileComponent
LFCR + LF (Some text editors cannot display these
codes correctly)
Linefeed Codes
Contains information released to both the syslog
and audit log information file and information
released only to the syslog information file. See
“Syslog Information File” (page 22) for more
information.
Contains login and logout information as well as
basic and detailed information about settings
made for each option. Basic information consists
of information common to each audit log.
Detailed information consists of information about
the operations of each executed option. This
includes an index representing each item and its
values.
File Output
1,024 bytes512 bytesMaximum Line
Size
250,000250,000Maximum
Number of Lines
244.6 MB122.5 MBMaximum File
Size
Check Audit Log - Event in the syslog information
file.
[Audit Log], Over Threshold
(File has reached 50% of the maximum number
of lines.)
[Audit Log], Over MaxLine
(Size of file has reached its maximum number of
lines and data is being overwritten.)
See #29 in “Items in the Syslog File” (page 23)
and “Syslog Information File Monitoring
Threshold” (page 26).
Once the information stored in the audit log
information file reaches its maximum capacity,
the starting line of the oldest data begins to be
overwritten with the starting line of the newest
data (wrap around).
When you reach 70% of this threshold, the yellow
Audit: Warning button appears on the Remote
Web Console main window. Start downloading
the audit log information file at or before this
threshold to prevent the old data from being
overwritten.
• If an FTP server is specified, the audit log
information file will be transferred to the FTP
server when the information stored in the audit
log information file reaches the 70% threshold.
• If the information stored in the audit log
information file exceeds the maximum, and
data is being overwritten, the red Audit:
Wraparound button appears.
• Once you download or transfer the audit log
information file, the counter is reset.
Do not use the transfer to the FTP server in
combination with the manual download. The line
counter will reset if the audit log information file
is downloaded manually while the transfer to the
FTP server is specified, and some information
may not be transferred to the FTP server.
Therefore, download the file manually only when
the transfer to the FTP server is disabled due to
a failure of the FTP server, or some other reason.
Threshold
Audit Log File Description 19