2.2.1 Logging Services Container

During your initial installation, Nsure Audit extends the eDirectory schema and creates the Logging Services container at the root of your directory tree. Because it is part of Nsure Audit, there can only be one Logging Services container per tree and, as the logging system container, it only contains Nsure Audit component objects.

Locating all logging system components in the Logging Services container is ideal for organizations that need a simple, easy-to-manage logging system. It also suits organizations that are implementing Nsure Audit as an auditing solution and, for security reasons, want to centrally manage their system. To facilitate distributed administration, however, Nsure Audit components can also be created and managed outside the Logging Services container.

If the Logging Services container is deleted, it can only be re-created by re-running AuditExt. For more information, see Section G.5, AuditExt.

2.2.2 Logging Server Object

In eDirectory, the Logging Server object represents the physical server where you installed the Secure Logging Server. However, because the Logging Server object is specific to Nsure Audit, it does not replace the NCP Server object. Instead, each Logging Server object is associated with an NCP Server object.

The Logging Server object is represented as a container with server attributes; it can contain Nsure Audit objects and it stores all the properties and attributes for the Secure Logging Server. For information on creating and configuring the Logging Server object, see Section 4.2, Configuring the Secure Logging Server.

2.2.3 Nsure Audit Attributes on the NCP Server Object

During installation, Nsure Audit extends the definition of the NCP Server object to include the log settings for eDirectory, NetWare, traditional file system, and NSS events. These settings are found under the NCP Server object's Nsure Audit tab.

The Nsure Audit screen has separate menus for NetWare, Filesystem, and eDirectory events. Each menu lists the events that fall in its respective category. To configure NetWare, Filesystem, or eDirectory instrumentation to log a particular type of event, simply mark the event's check box and click Apply. The instrumentation automatically begins logging the marked events to the Secure Logging Server.

For more information on configuring the NCP Server object's Nsure Audit attributes, see Section 5.0, Logging eDirectory, NetWare, and File System Events.

2.2.4 Application Objects

Application objects are associated with applications that log to or request information from Nsure Audit. These objects store the information required by the logging server to authenticate logging applications. They also identify which users have rights to monitor the applications' events and they store the applications' log schemas.

Application objects are usually created automatically when either Nsure Audit or the logging application is installed. If necessary, they can also be manually added to the tree using iManager.

During installation, Novell Nsure Audit automatically creates Application objects for itself (the Naudit Instrumentation), the eDirectory Instrumentation, and the NetWare Instrumentation.The Naudit Instrumentation allows Nsure Audit to audit its own events such as creating Channel or Notification objects. The eDirectory Instrumentation manages logging of eDirectory events and the NetWare Instrumentation provides logging for NetWare and file system events.

Application objects can be created only within Application containers. Novell Nsure Audit creates the Application objects for the Naudit, eDirectory, and NetWare Instrumentations in the Application container under Logging Services.

For more information on creating and configuring Application objects, see Section 6.0, Managing Applications that Log to Nsure Audit.

2.2.5 Channel Objects

Channel objects store the information the logging server needs to use channel drivers. For example, a MySQL Channel object contains the IP address or host name of the MySQL database server; a username and password for connecting to the server, the name of the database and table, and any other relevant information. An SMTP Channel object, on the other hand, includes the address of the SMTP server; a username and password; and the recipient, sender, subject, and body of the log message.

Nsure Audit is designed so you can create multiple Channel objects for any given channel. This means you can apply different channel configurations to different functions or events. For instance, you can configure the logging server to use one MySQL Channel object to add events to the central data store and configure a Notification Filter to use another MySQL Channel object to create a filtered log.

The available types of Channel objects are:

Additional Channel objects can be easily incorporated in this model. For more information, see the Nsure Audit SDK.

Of particular note is the Critical Value Reset (CVR) Channel object. In configuring a CVR Channel object, you can flag an attribute in eDirectory with a reset policy. If the value of that specific attribute is changed, the CVR channel automatically resets the value as per the policy defined in the CVR Channel object.

The logging server looks for Channel objects only in Channel containers; therefore, Channel objects can only be created within Channel containers. For information on creating and configuring Channel objects, see Section 7.0, Configuring System Channels.

2.2.6 Notification Objects

Nsure Audit provides two kinds of event notification:

Filtered notification tells you when a specific event has occured; heartbeat notification tells you when an event has not occured. The following sections discuss the objects associated with each notification.