OES2 stops sending NSS audit events to Sentinel server

Document ID:7009667
Creation Date:31-Oct-2011
Modified Date:27-Apr-2012
- Micro Focus Products:
  Audit
  Open Enterprise Server
  Sentinel

Environment

Novell Audit
Novell Open Enterprise Server 2 (OES 2) Linux
Novell Sentinel 6.1
vlog
sentagent
Novell Storage Services (NSS)

Situation

Sentinel not logging OES2 NSS events
OES2 servers stop sending events to Sentinel servers
Sentinel server stops receiving events from OES2 servers
Files start accumulating/building up/stacking in /var/log/audit/vlog/SENTINEL
Multiple SENTINEL_*.log files e.g. SENTINEL_000000004EAE753F_068238.log

Resolution

Add the -Q parameter to /usr/local/sbin/sentsubagent.conf

vlog /opt/novell/vigil/bin/vlog --v2sent -Q -F /usr/local/sbin/vlogfilters

Restart sentagent

/etc/init.d/sentagent restart

Additional Information

By default vlog ignores stdin commands, so if flow control is required, the -Q option needs to be specified on the command line along with the -v2sent option. vlog then creates a pthread in which it processes "Start/Stop processing events" and accordingly starts or stops sending vlog events.