Process flow for logcfg logging
The following example process flow assumes the [aznapi-configuration] stanza of a WebSEAL configuration file.
Use the syntax of the logcfg entry to specify a log file. The log file is opened at WebSEAL initialization. If no log file is opened during initialization, regardless of other configuration settings, no events are logged. Unless a log file is specified, all event data is lost.
[aznapi-configuration] logcfg = http.agent:file path=abc.log,log_id=agent
We can use the log_id identifier to facilitate the recording of events from different categories to the same file. We can construct more log agents. The log agents can gather different event data. These agents use log_id to direct the data to the log file that was opened by the initial log agent. The first logcfg entry must be used to define the log agent. If the log agent is defined after the first log_id, no events for that category are logged.
In the following example, events from the http.agent category are directed to the abc.log file. The log agent has the log_id=httplogs identifier. Events from http.ref and http.clf audit categories are also logged to this file because the logcfg entry uses the same identifier log_id=httplogs:
[aznapi-configuration] logcfg = http.agent:file path=abc.log,log_id=httplogs logcfg = http.ref:file log_id=httplogs logcfg = http.clf:file log_id=httplogs
Parent topic: Audit event logging