IBM Tivoli Monitoring > Version 6.3 Fix Pack 2 > Administrator's Guide > Audit logging

IBM Tivoli Monitoring, Version 6.3 Fix Pack 2

Audit environment variables

Environment variables can be modified to control the audit capability.


Environment variables

The following environment variables are defined for configuring the Auditing Facility:

Environment variable Description Acceptable input Default if not defined
AUDIT_FILE Used to disable the creation of an xml audit.log. Audit events are still created in the ITM Audit table.

  • Disabled

  • Enabled

Not Supported is a state that is not accepted as input but may be returned on platforms that do not create audit logs, such as z/OS systems.

Enabled
AUDIT_LOG_DIR
_PATH 		Path to the directory where the audit log files are kept. Not available on z/OS systems. Note: If you change the output directory, the pdcollect tool cannot collect the associated audit log. Provide an operating system specific path. <install_dir>/auditlogs
AUDIT_LOG_FILE
_LIMIT_MB 		The maximum file size of the log file in megabytes (2^20 bytes). 1 - MAXINT-1 9
AUDIT_LOG_FILE
_NAME 		The log file name. Not available on z/OS systems. Provide the log file name. <UserID>.<hostname>_<pc>_audit.log
AUDIT_LOG_MAX
_FILES_COUNT 		Maximum number of log files for rollover. This variable applies only to distributed platforms. Not available on z/OS systems. 1...MAXINT-1 (on distributed) 5
AUDIT_MAX_HIST Maximum number of records kept in short-term memory for direct queries. 1...MAXINT-1 100
AUDIT_TRACE The trace level to pass messages. Message trace levels (from low to high) are Minimum, Basic, Detail. Higher levels trace all lower levels.

  • Minimum

  • Basic

  • Detail

  • Disabled

Basic
ITM_DOMAIN An optional 128-character identifier on distributed systems and 32-character identifier on z/OS systems that you can use to associate with these records. Best suited for commonly identifying agents that are associated with each other. You might use this variable for sorting records by a particular customer. Case is preserved. Provide an alphanumeric string that can contain the plus (+), minus (-), semicolon (;), and colon (:) characters. No domain is provided.


Modifying the Audit environment variables

You can configure the tracing environment variable for the Auditing Facility using the following procedures. You can modify any of the environment variables previously mentioned.

Use Manage Tivoli Enterprise Monitoring Services (Start → Programs → IBM Tivoli Monitoring → Manage Tivoli Enterprise Monitoring Services) to edit environment files. Right-click the component you want to modify and click Advanced → Edit ENV File. You must recycle the component to implement the changes.

  1. Change to the <install_dir>/config directory and open the coordinating file:

    • For the monitoring server: <hostname>_ms_<tems_name>.config

    • For the portal server and single-instance agents: <pc>.ini

    • For multi-instance agents: <pc>_<instance>.config

  2. On a new line, add the environment variable followed by the value. For example, AUDIT_TRACE=BASIC

  3. Save and close the file.

  4. Recycle the component to have your changes take effect.

See Configure the Tivoli Enterprise Monitoring Server on z/OS for more information.


Parent topic:

Audit logging

+

Search Tips   |   Advanced Search