+

Search Tips   |   Advanced Search

AuditEventFactoryCommands (AdminTask)

We can use the Jython scripting language to configure the security auditing system with wsadmin.sh. Use commands in the AuditEventFactoryCommands group to configure the default or a third-party audit event factory.

Use the following commands to configure the default audit event factory or a third-party audit event factory:


createAuditEventFactory

The createAuditEventFactory command creates an audit event factory in the security auditing system configuration. We can use the default implementation of the audit event factory or use a third-party implementation. To configure a third-party implementation, use the optional -customProperties parameter to specify any properties necessary to configure the audit event factory implementation.

User must have auditor role.

Target object: None.

Required parameters

-uniqueName

Unique name identifying audit event factory. (String, required)

-className

Class implementation of the audit event factory interface. (String, required)

-provider

Specifies a reference to a predefined audit service provider implementation. (String, required)

-auditFilters

Specifies a reference or a group of references to predefined audit filters, using the following format: reference, reference, reference (String, required)

Optional parameters

-customProperties

Specifies any custom properties necessary to configure a third-party implementation. (String, optional)

Return value

The command returns the shortened reference ID for the newly created audit event factory.

Batch mode example

Interactive mode


deleteAuditEventFactoryByName

The deleteAuditEventFactoryByName command deletes the audit event factory implementation in the audit.xml file that matches a specific unique name identifier.

User must have auditor role.

Target object: None.

Required parameters

-uniqueName

Unique name of the audit event factory implementation. (String, required)

Return value

Returns true if the system successfully deletes the audit event factory.

Batch mode example

Interactive mode


deleteAuditEventFactoryByRef

The deleteAuditEventFactoryByRef command deletes the audit event factory implementation that matches the reference ID of interest.

User must have auditor role.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Return value

Returns true if the system successfully deletes the audit event factory.

Batch mode example

Interactive mode


getAuditEventFactory

The getAuditEventFactory command retrieves the list of attributes for the audit event factory implementation in the audit.xml file for a specific reference id.

The user must have the monitor administrative role to run this command.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Return value

The command returns an attribute list for the audit event factory implementation of interest, as the following example output displays: 

{{name myeventfactory}
{properties {{{validationExpression {}}
{name a}
{description {}}
{value b}
{_Websphere_Config_Data_Id cells/Node04Cell|audit.xml#Property_1184688593531}
{_Websphere_Config_Data_Type Property}
{ required false}}}}
{className com.mycompany.myeventfactoryclass}
{auditServiceProvider auditServiceProviderImpl_1(cells/Node04Cell|audit.xml#AuditServiceProvider_1173199825608)}
{auditSpecifications DefaultAuditSpecification_1(cells/Node04Cell|audit.xml#AuditSpecification_1173199825608)}
{_Websphere_Config_Data_Id cells/Node04Cell|audit.xml#AuditEventFactory_1184688293515}
{_Websphere_Config_Data_Type AuditEventFactory}}

Batch mode example

Interactive mode


getAuditEventFactoryClass

The getAuditEventFactoryClass command retrieves the class name of the audit event factory implementation that matches a specific reference ID in the audit.xml configuration file.

The user must have the monitor administrative role to run this command.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Return value

The command returns the class name of the audit event factory of interest, as the following sample output displays:

Batch mode example

Interactive mode


getAuditEventFactoryFilters

The getAuditEventFactoryFilters command retrieves a list of defined filters for the passed-in event factory.

The user must have the monitor administrative role to run this command.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Return value

The command returns a list of the defined filters for the event factory reference of interest in a shortened format, as the following sample output displays:

Batch mode example

Interactive mode


getAuditEventFactoryName

The getAuditEventFactoryName command retrieves the unique name of the audit event factory implementation that matches a specific reference ID in the audit.xml configuration file.

The user must have the monitor administrative role to run this command.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Return value

The command returns the name of the audit event factory, as the following sample output displays:

Batch mode example

Interactive mode


getAuditEventFactoryProvider

The getAuditEventFactoryProvider command retrieves the object name of the audit service provider that a specific audit event factory implementation uses in the audit.xml configuration file.

The user must have the monitor administrative role to run this command.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Return value

The command returns the object name of the audit service provider for the audit event factory of interest, as the following sample output displays:

Batch mode example

Interactive mode


listAuditEventFactories

The listAuditEventFactories command retrieves a list of audit event factory objects and their attributes defined in the audit.xml file.

The user must have the monitor administrative role to run this command.

Target object: None.

Return value

The command returns an array list of audit event factories and attributes, as the following example output displays: 

{{auditSpecifications DefaultAuditSpecification_1(cells/Node04Cell|audit.xml#AuditSpecification_1173199825608)
DefaultAuditSpecification_2(cells/Node04Cell|audit.xml#AuditSpecification_1173199825609)
DefaultAuditSpecification_3(cells/Node04Cell|audit.xml#AuditSpecification_1173199825610)
DefaultAuditSpecification_4(cells/Node04Cell|audit.xml#AuditSpecification_1173199825611)}
{name auditEventFactoryImpl_1}
{_Websphere_Config_Data_Id cells/Node04Cell|audit.xml#AuditEventFactory_1173199825608}
{_Websphere_Config_Data_Type AuditEventFactory}
{auditSpecRef4 AuditSpecification_1173199825611}
{properties {}}
{auditSpecRef3 AuditSpecification_1173199825610}
{className com.ibm.ws.security.audit.AuditEventFactoryImpl}
{auditServiceProvider auditServiceProviderImpl_1(cells/Node04Cell|audit.xml#AuditServiceProvider_1173199825608)}
{auditSpecRef2 AuditSpecification_1173199825609}
{auditSpecRef1 AuditSpecification_1173199825608}
{auditEventFactoryRef AuditEventFactory_1173199825608}
{emitterRef AuditServiceProvider_1173199825608}}
{{auditSpecifications myfilter(cells/Node04Cell|audit.xml#AuditSpecification_1184598886859)}
{name myeventfactory}
{_Websphere_Config_Data_Id cells/Node04Cell|audit.xml#AuditEventFactory_1184688293515}
{_Websphere_Config_Data_Type AuditEventFactory}
{className com.mycompany.myeventfactoryclass}
{auditServiceProvider auditServiceProviderImpl_1(cells/Node04Cell|audit.xml#AuditServiceProvider_1173199825608)}
{properties {{{validationExpression {}}
{name a}
{description {}}
{value b}
{_Websphere_Config_Data_Id cells/Node04Cell|audit.xml#Property_1184688293546}
{_Websphere_Config_Data_Type Property}
{ required false}}}}
{auditSpecRef1 AuditSpecification_1184598886859}
{auditEventFactoryRef AuditEventFactory_1184688293515}
{emitterRef AuditServiceProvider_1173199825608}}

Batch mode example

Interactive mode


modifyAuditEventFactory

The modifyAuditEventFactory command modifies the attributes of the audit event factory implementation that the command references with the reference id.

User must have auditor role.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

Optional parameters

-provider

Reference ID of an audit service provider implementation. (String, optional)

-className

Name of the class that implements the audit event factory interface. (String, optional)

-customProperties

Specifies one or more custom properties to associate with the audit event factory of interest. Use the following format: name=value, name=value (String, optional)

-auditFilters

List of references to audit filters that exist in the configuration. We can separate each item in the list with a comma (,), a semicolon (;), or a space. (String, optional)

Return value

Returns true if the system successfully updates the security auditing system configuration.

Batch mode example

Interactive mode


setAuditEventFactoryFilters

The setAuditEventFactoryFilters command sets the filters for an audit event factory implementation.

User must have auditor role.

Target object: None.

Required parameters

-eventFactoryRef

Specifies an audit event factory implementation. This parameter can be a reference to the event factory object. (String, required)

-filtersRef

List of references to defined audit filters. (String, required)

Return value

Returns true if the system successfully sets the filters for the audit event factory.

Batch mode example

Interactive mode

  • AuditKeyStoreCommands (AdminTask)
  • AuditEmitterCommands (AdminTask)
  • AuditSigningCommands (AdminTask)
  • AuditEncryptionCommands (AdminTask)
  • AuditFilterCommands (AdminTask)
  • AuditNotificationCommands (AdminTask)
  • AuditPolicyCommands (AdminTask)
  • AuditEventFormatterCommands (AdminTask)