Smarts SAM: What is the difference between the DMT audit log and SAM audit file and Archive log ? How do I roll these logs?
Article ID: 331679
Updated On:
Products
VMware Smart Assurance
Environment
VMware Smart Assurance - SMARTS
Resolution
What is the difference between the Smarts DMT audit log and Smarts SAM audit file?
How to roll the Smarts DMT audit log, the Smarts SAM audit file and the archive log using dmctl commands.
DMT audit log
The default name of this log is INCHARGE_SA_audit.log
The DMT audit log was added to SAM starting with SMARTS Version 9.1.x The DMT flag, when invoked and used in the /local/conf/runcmd_env.sh file, SM_AUDIT_ALL_CONNECTIONS=1 enables connection auditing, and will create a <server>_audit.log that contains information about what remote API commands are being executed by remote clients.
To roll this audit log, you execute the "roll_audit_log" program through the DMCTL command:
./dmctl -s <SAM domain name> exec roll_audit_log
SAM audit file
The default name of this log is INCHARGE_SA_audit
This file gets created automatically by the Smarts SAM domain and contains history information about notifications such as the NOTIFY, CLEARS, and other updates to the notifications. This file is rolled using the roll_sam_auditlog program through the DMCTL command:
./dmctl -s <SAM Domain Name> exec roll_sam_auditlog
SAM archive.log
The default name of this log is INCHARGE_SA_archive
Smarts will document the archival history of the notifications being archived in the SAM archive.log file.
To roll the .archive file
./dmctl -s <domain name> exec roll_sam_archivelog
How to roll the Smarts DMT audit log, the Smarts SAM audit file and the archive log using dmctl commands.
DMT audit log
The default name of this log is INCHARGE_SA_audit.log
The DMT audit log was added to SAM starting with SMARTS Version 9.1.x The DMT flag, when invoked and used in the /local/conf/runcmd_env.sh file, SM_AUDIT_ALL_CONNECTIONS=1 enables connection auditing, and will create a <server>_audit.log that contains information about what remote API commands are being executed by remote clients.
To roll this audit log, you execute the "roll_audit_log" program through the DMCTL command:
./dmctl -s <SAM domain name> exec roll_audit_log
SAM audit file
The default name of this log is INCHARGE_SA_audit
This file gets created automatically by the Smarts SAM domain and contains history information about notifications such as the NOTIFY, CLEARS, and other updates to the notifications. This file is rolled using the roll_sam_auditlog program through the DMCTL command:
./dmctl -s <SAM Domain Name> exec roll_sam_auditlog
SAM archive.log
The default name of this log is INCHARGE_SA_archive
Smarts will document the archival history of the notifications being archived in the SAM archive.log file.
To roll the .archive file
./dmctl -s <domain name> exec roll_sam_archivelog
Feedback
Yes
No
Powered by
