Exporting Data

The access control log is stored in a Btrieve* file on the Novell BorderManager 3.7 server and is maintained by CSAUDIT.NLM. The access log cannot be edited or manipulated from the server; however, the data can be exported for analysis. The format of the exported data is compatible with trend analysis software packages, such as WebTrends*.

There are two ways to export the access control log from NetWare Administrator:

• Exporting Data from the Access Control Users Statistics Window
• Exporting Data Using the Export Logs Option

If you use the second method, you can also combine the audit log files from other Novell BorderManager 3.7 services with the access control log into a single ASCII file.

Exporting Data from the Access Control Users Statistics Window

To export records from the Access Control Users Statistics window:

1. In NetWare Administrator, click the server object representing the Novell BorderManager 3.7 server.

2. Click Tools > Novell Novell BorderManager 3.7.

3. Click Novell BorderManager 3.7 > View Access Control.

4. Click Display Records > enter the dates for the records you want to display > click OK.

5. In the Access Control Users Statistics window, click Export Data > enter the path and filename.

   Or

   Click Browse to select the destination of the export file.

6. Select one of the following sort formats under Information Output Selection and click OK.

   • Entry Time (connection by connection)---(Default selection) Sorts records from the earliest entry time to latest entry time.
   • Access by users---Sorts records in alphabetic order based on the user's NDS or eDirectory username.
   • Access by hosts---Sorts records in ascending order (for IP addresses) or alphabetic order (for DNS hostnames).

7. If the export filename already exists under the directory path selected, you are prompted to replace the file. Click Yes to overwrite the file or No to specify the destination as described in Step 5.

The record fields are written to disk with a tab as the delimiter. Each record ends with a carriage return and line feed. The exported data has the following format:

• Entry Time---Time connection was established.
• Username---NDS or eDirectory name or IP address of the user.
• Access---Action specified in the access rule for this connection: either Allowed or Denied.
• Protocol---Protocol string representing the port number used for the connection: HTTP, FTP, HTTPS, and so on. For example, HTTP represents a connection made using port 80.
• Hostname---DNS name or IP address of the accessed host.
• Service---Service used to access the host: Proxy Services or Novell IP Gateway.
• Rule Number---ID number of the rule that grants or denies access to the hosts.

Exporting Data Using the Export Logs Option

The procedure to export access control data using the Export Logs option from the Novell BorderManager 3.7 menu extracts the same data from the Btrieve database, but offers additional export options that cannot be activated from the Access Control Users Statistics window.

To export the access control log:

1. In NetWare Administrator, click the server object representing the Novell BorderManager 3.7 server.

2. Click Tools > Novell Novell BorderManager 3.7.

3. Click Novell BorderManager 3.7 > Export Logs.

4. Click Set Range to enter the date range.

   This is the range of dates comparable to the dates used to display records in the Access Control Users Statistics window. The default range is the current server date.

5. Click Browse to select the drive mapped to the destination for the export file.

   This is the path and filename for the export file. The default destination is A:\YYYYMMDD.LOG, where YYYY is the current year, MM is the current month, and DD is the current day. If you change the filename from the default format, the filename will not reflect the current server date. For example, if you change the filename format to MMDDYYYY.LOG, the next time you try to export logs on another day, the log filename will not have incremented to the current date.

6. (Optional) If the default filename is unacceptable, enter the filename in the File field.

7. (Optional) If you want to combine the access control log with audit logs from other Novell BorderManager 3.7 services, check the Combine Log Files check box.

   This feature allows log files from different services to be combined into a single output file. When log files are combined, they are appended to one file, service by service.

8. Under Log Selection, check the box for ACL.

   If the Combine Log Files feature has been selected, check all the services whose data will be combined into the export log file.

9. (Optional) If you checked Combine Log Files in Step 7, under Log Selection, check all other Novell BorderManager 3.7 services audit log files to be combined with the access control log file.

10. Click OK.

The access control log is exported to an ASCII file. The record fields are written with a tab as the delimiter. Each record ends with a carriage return and line feed. The exported access control data has the following fields:

• Keyword---ACL. If the Combine Log Files option was selected, the keyword is at the beginning of each line from the access control list (ACL) audit log.
• Date.
• Time.
• Source---Typeless eDirectory name and context, such as mlira.pubs.novell, or an IP address.
• Destination---Domain name or IP address.
• Bytes received.
• Status---Allow or Deny.
• Protocol---Protocol used, such as HTTP or FTP.
• Service---Service used to access the host: Proxy Services or Novell IP Gateway.
• Rule ID---An 8-digit hexadecimal number that identifies the rule associated with the allowed or denied access.

If the Combine Log Files feature is not selected and you select one or more services under the Log Selection field, a separate export file is created for each service under a subdirectory of the export destination path.

The export subdirectories used are shown in the following table.

For example, if you specified an export destination of VOL1:LOGS\19981019.LOG, did not select the Combine Log Files feature, and checked the boxes for HTTP Proxy, SOCKS client, and ACL, the following log files would result:

• VOL1:LOGS\HTTP\19981019.LOG
• VOL1:LOGS\SOCKS\19981019.LOG
• VOL1:LOGS\ACL\19981019.LOG