NIO CommKit Host Interface Installation and System Administration Manual

DKAUDIT(4) DKAUDIT(4)
E-71 CommKit Host Interface, Release 4.0
NAME
dkaudit – host interface connection auditing record formats
DESCRIPTION
Connection auditing records are generated by the dkux(7) call processing module and are logged by the
dkdaemon(1M) process when enabled by the dkux(7) tunable parameters and the dkdaemon(1M) run-time
options. The auditing records are described below:
UNIXP Messages
These time-stamped messages document UNIXP message exchanges between dkux(7) and the peer process in
the AT&T data switch controller. Both inbound and outbound messages may be recorded:
Month Day HH:MM:SS UNIXP: (Intf, Chan) <= 12 Hexadecimal Bytes of message
Month Day HH:MM:SS UNIXP: (Intf, Chan) => 12 Hexadecimal Bytes of message
Intf and Chan describe the physical interface and channel targeted by the message; inbound messages are
marked with <=, and outbound with =>.
Typical messages from a log might look like:
Oct 9 16:28:00 UNIXP: (0, 30) <= 03 02 1e 00 00 00 00 00 00 00 00 00
Oct 9 16:47:58 UNIXP: (0, 30) <= 03 01 1e 00 32 00 00 00 00 00 00 00
Oct 9 16:47:58 UNIXP: (0, 1) => 03 01 1e 00 00 00 00 00 00 00 00 00
SERVER Messages
dkserver(1M) start-up attempts are recorded as time-stamped SERVER messages. The primary form of the
SERVER audit message lists the numerical user ID (UID) of the process attempting the DKANNOUNCE
server startup request:
Month Day HH:MM:SS SERVER: (Intf, Chan) "ServerName" Started by UID UID
Month Day HH:MM:SS SERVER: (Intf, Chan) "ServerName" Failed by UID UID
Successful attempts are marked Started and unsuccessful ones Failed. ServerName is the dkserver(1M)
name provided in the request.
Servers started through dktli(7) do not provide a user ID and are recorded without the "by UID" information:
Month Day HH:MM:SS SERVER: (Intf, Chan) "ServerName" Started
Month Day HH:MM:SS SERVER: (Intf, Chan) "ServerName" Failed
A dkserver(1M) started by root with the name ’probe’ would create the following example audit entry:
Oct 9 14:16:54 SERVER: (0, 2) "probe" Started by UID 0
CONNECTION Messages
Outgoing connection attempts are recorded as time-stamped CONNECTION messages. The primary form of
the CONNECTION audit message lists the numerical user ID (UID) of the process attempting the
dkdial(3X) connection request:
Month Day HH:MM:SS CONNECTION: (Intf, Chan) "DialString" Started by UID UID
Month Day HH:MM:SS CONNECTION: (Intf, Chan) "DialString" Failed by UID UID
DialString is the full dialstring sent to the data switch controller, including the generated newline and user ID
if used. Successfully established connections are marked Started and failed attempts Failed.
Some connections made through dktli(7) may not include the "by UID" information:
Month Day HH:MM:SS CONNECTION: (Intf, Chan) "DialString" Started
Month Day HH:MM:SS CONNECTION: (Intf, Chan) "DialString" Failed