Endpoint Administration Guide for UNIX › Auditing Events › Warning Mode › The System Auditor › Set Up the Log Routing Facility

Set Up the Log Routing Facility

To set up the log routing

1. Create a log routing configuration file.

   Unless you specify otherwise with the RouteFile token in the seos.ini file, CA ControlMinder expects your log routing configuration file to be named ACInstallDir/log/selogrd.cfg

   where ACInstallDir is the installation directory for CA ControlMinder, by default /opt/CA/AccessControl.

   You can find sample log routing configuration files in the directory ACInstallDir/samples/selogrd.init. Alternatively, as a very simple log routing configuration file, you can create a file consisting of the following three lines:

   Rule
   host destination
   .
   

   For destination, enter the name of the host that should receive the audit records. All classes, resources, accessors, and results are logged.

   Note: For more information about the syntax of the configuration file, see the selogrd utility in the Utilities Guide.

2. Start the emitter daemon (selogrd) on all hosts that are to route auditing information, and execute the collector daemon (selogrcd) on all hosts that are to collect auditing information.

   Note: For more information about using these daemons, see the Reference Guide.