21.1 Setting Up Logging Server and Console Events

Secure Logging Server manages the flow of information with the auditing system. It performs the following actions:

Receives incoming events and requests.
Logs information to the data store.
Monitors designated events.
Provides filtering and notification services.
Resets critical system attributes according to a specified policy automatically.

Specifying the logging server details:

Click Auditing.

Specify the following details:

Field	Description
Audit Messages Using	Select any one of the following options: Log File (Not Recommended For Production): Audit events are sent to a local log file. Windows: Identity Server and ESP: "C:\Program Files\Novell\Syslog\audit_common.log" Access Gateway: "C:\Program Files\Novell\Syslog\audit_ag.log" Linux: Identity Server and ESP: /var/opt/novell/syslog/audit_common.log Access Gateway: /var/opt/novell/syslog/audit_ag.log Syslog: The available options are: NOTE:These options are available in Access Manager 4.5 Service Pack 1 and earlier versions. Send to Sentinel: Audit events are sent in the CSV format. Send to Third party: Audit events are sent in the JSON format. If Administration Console is configured as a remote Audit server for syslog, audit logs are sent to /var/log/NAM_Audits.log. Send to Analytics Server: The audit events are sent in the CSV format. See Important Points to Consider When Using Syslog.
Stop Services on Audit Server Failure	Select to stop the Apache services when the audit server is offline or not reachable and audit events could not be cached.
Server Listening Address (Access Manager 4.5 Service Pack 1 and earlier)	Specify the IP address or DNS name of the audit logging server you want to use. If you want to use a different Secure Logging Server, specify that server here. For example, specify syslog server details if you select syslog.
Auditing Server 1 (Access Manager 4.5 Service Pack 2 and later)	Specify the IP address or DNS name of the audit logging server you want to use. You can send the audit events to a maximum of two audit servers at a time. For example, you can use the Sentinel server as Auditing Server 1 and any Third party server as Auditing Server 2.
IMPORTANT:If you have configured Analytics Server cluster, the virtual IP address is auto-populated. On Windows, if syslog is selected for auditing, Server Listening Address is disabled. To specify the server details, manually install and configure the local syslog client.
Server Listening Address (Access Manager 4.5 Service Pack 2 and later)	Specify the IP address or DNS name of the second audit logging server you want to use. You can send the audit events to a maximum of two audit servers at a time. If your auditing server is in a private network, you can specify the public NAT IP address of the auditing server instead of the IP address or DNS name of the auditing server. Using this address, devices can contact the auditing server.
Port	Specify the port that syslog uses to connect to the Secure Logging Server. For Sentinel server, the default port is 1468. For third-party syslog servers, specify the configured port of that server. For Analytics Server, specify 1468.
Format (Access Manager 4.5 Service Pack 2 and later)	You can choose to send the audit events in CSV or JSON format.
Server Public NAT Address	If your auditing server is in a private network, specify the public NAT IP address of the auditing server. Using this address devices can contact the auditing server. To use Sentinel server or Sentinel Log Manager, specify the IP address or DNS name of the Sentinel.
Send Audit Events to Interset Behavioral Analytics Server (Access Manager 4.5 Service Pack 3 and later)	This is a read-only field. It indicates whether you have configured to send audit events to Interset for behavioral analytics. For more information, see Section 10.7.4, Configuring Behavioral Analytics.
IMPORTANT:If you select Sentinel server for auditing through syslog, you must use the latest Access Manager Collector for Sentinel.
Management Console Audit Events	Select the system-wide events that you want to audit. Select All: Selects all audit events. Health Changes: Generated whenever the health of a server changes. Server Imports: Generated whenever a server is imported into Administration Console. Server Deletes: Generated whenever a server is deleted from Administration Console. Server Statistics: Generated periodically whenever statistics are generated for server. Configuration Changes: Generated whenever you change a server configuration.

Click OK.

It might take up to 15 minutes for the events you selected to start appearing in the audit files.
(Conditional) If you want to change the IP Address of Analytics Server, you must change the IP Address of the primary Analytics Server. For information about changing the primary IP address, see Section 3.7.3, Managing Details of a Cluster.
(Conditional) If Administration Console is the only Access Manager component installed on the machine and you have changed the address or port of the Secure Logging Server, complete the following steps:

For security reasons, the Novell Audit Configuration file cannot be modified using Administration Console when it is the only Access Manager component on the machine. Only a system administrator can edit this.

If syslog is selected for auditing, perform the following configuration:

In the /etc/sysconfig/syslog file, change the SYSLOG_DAEMON value to rsyslog. This changes the default syslog daemon to rsyslog.
Edit the /etc/rsyslog.d/nam.conf file and specify the following parameters:

Sample nam.conf file:
```
$InputTCPServerRun 1290
$template ForwardFormat,"<%PRI%>%TIMESTAMP:::date-rfc3164% %HOSTNAME% %syslogtag:1:32%%msg:::sp-if-no-1st-sp%%msg%\n"
local0.* @@172.16.50.50:1468;ForwardFormat
```
This enables the local rsyslog agent to communicate to local TCP port 1290 and forward the audit message to the remote server 172.16.50.50 communicating with port 1468.
Restart the local syslog daemon.
Select JSON as the audit message format and syslog as audit server type by editing the file /etc/Auditlogging.cfg.

Sample Auditlogging.cfg file:
```
LOGDEST=syslog
FORMAT=JSON
SERVERIP=127.0.0.1
SERVERPORT=1290
```
Restart Administration Console.
Open a terminal window and run the following command:

/etc/init.d/novell-ac restart OR rcnovell-ac restart
Restart syslog by running the following commands:
- SLES 11 SP4: rcrsyslog restart
- SLES 12 SP4: rcsyslog restart OR systemctl restart rsyslog
- RHEL 6.9: service rsyslog restart
- RHEL 7.6: systemctl restart rsyslog.service
Restart each device imported into Administration Console.

The devices (Identity Server and Access Gateway) do not start reporting events until they have been restarted.

NOTE:The eDirectory audit configuration remains unchanged even after you upgrade to the latest version of Access Manager. To fetch eDirectory audit events, manually unload and re-load the audit modules. Perform this activity each time you start eDirectory.

To install and enable eDirectory packages, see Installing Novell Audit Packages in the eDirectory Administration Guide.