A.4 Log Schema Files
Log Schema (LSC) files catalog the events that can be logged for a given application. They also provide event descriptions and field titles, although this is optional. For information on creating Log Schema files, see the Novell Audit SDK.
Novell Audit stores LSC files as attributes in their respective Application object. (English LSC files are stored under the NAuditAppSchemaEn attribute.) Typically, logging applications use the AuditExt utility to automatically create their associated Application object and to populate the Application object’s log schema attribute; however, if you modify or localize an LSC file, you can manually add it to the Application object using the AuditExt utility. For more information on this procedure, see Using AuditExt to Add LSC Files to Application Objects.
A.4.1 How LSC Files Are Used
The information stored in the log schema files—specifically Event IDs, Group IDs, Text and Numeric field values—is useful in defining query statements, Notification Filters, and Heartbeat Notifications. For example, if you want to receive a notification anytime a server goes down, you must first look up the Event ID for the Server Down event in the NetWare log schema. You can then configure a Notification Filter that selects events with an Event ID of 000A0103.
The File and Syslog drivers use the log schemas to create localized, human-readable log files. At startup, the File and Syslog channel drivers load each application’s log schema in memory. If a logging application has multiple language versions of its log schema, the drivers load the schema for the language designated in their respective Channel objects. The File and Syslog channel drivers then reference the log schemas to write localized event descriptions to their log files.
NOTE:If the File and Syslog Channel objects reference the same language, the drivers independently load the log schema in their own memory. The only time the log schema is shared is between multiple instances of the same driver. For example, if you have two File channels configured to write Translated log files in English, the English log schema for each application is loaded only once. For more information, see File Channel Driver and Syslog Channel Driver.
iManager and Novell Audit Report also reference the log schemas. They use the Field titles defined in the log schemas to label column headings and event fields in the query results.
Figure A-2 Query Result Column Headings
iManager and Novell Audit Report manually import log schemas from the Application objects. For information on importing and viewing log schema files, see Managing Product Events in iManager and Section 8.2.6, Importing and Viewing Events in Novell Audit Report.
A.4.2 Localized Log Schema Files
Although there is only one log schema for a given application, there can be many localized versions of the LSC file. Novell Audit stores each language version of the LSC file as an attribute in its respective Application object. For example, English LSC files are stored under the NAuditAppSchemaEn attribute; German LSC files are stored under the NAuditAppSchemaDe attribute; and so forth.
IMPORTANT:Each language version of the LSC file must be added to the Application object before it can be used by the Syslog and File channel drivers to create localized log files.
Novell Audit Report and iManager only support one language version of each log schema file at a time.
A.4.3 Adding LSC Files to Application Objects
During installation, logging applications use the AuditExt utility to automatically create their associated Application objects and to populate the Application objects’ log schema attribute. However, if you modify or localize an LSC file, you can manually add it to the Application object using the AuditExt utility at the server console.
To add a log schema to an Application object using AuditExt, enter the following command at the server console:
auditext -lsc -u:username -p:password "-a:Application_object" -f:LSC_file -l:language
For example,
auditext -lsc -u:admin -p:argl "-a:eDirectory Instrumentation" "-f:\temp\edir.lsc" -l:en
If the path to the LSC file contains spaces, enclose the path and the -f flag in quotation marks. For example, "-f:c:/my files/myapp.lsc" .
AuditExt requires that the first line of all LSC files is formatted as follows:
#^object_name^Application_ID^Application_Identifier^language_identifier
Each parameter is explained below.
Table A-7 AuditExt Parameters
If no path is given, AuditExt looks for the log schema files in the working directory of AuditExt. By default, schema log files are contained following directories: