Configure file log agents

To record events in a file, specify a log file configuration as follows:

[ivacld]
logcfg = category:file path=file_pathname, flush_interval=num_seconds,
rollover_size=number,max_rollover_files=number,log_id=logid,
queue_size=number,hi_water=number,buffer_size=number,mode={text|binary}

Parameter names can be shortened to any unambiguous name. For example, the hi_water parameter can be shortened to hi. A file is opened only one time. The file opens according to the options in the first configuration entry that is processed when:

• Multiple configuration entries exist.
• You want to selectively capture events to the same file.
• You want to capture events at different points of the event pool hierarchy.

After a file was opened, further file configurations can use the following shorthand notation to record events to the same file:

[ivacld]
logcfg = category:file log_id=logid

Writing to a file can be a slow operation relative to the tasks that are generating events. Therefore, events are posted to a file log agent through a second level of queuing. This second level of event queuing is configured like the central event propagation queue, but has different default values.

• Parameters for file log agents
  We can define the following parameters for file log agents:
• Sending events to a log file
  We might configure IBM Security Verify Access to send event records to a log file.

Parent topic: Defining logcfg entries