HP Security Monitor/iX Manager's Guide: HP 3000 MPE/iX Computer Systems > Chapter 7 Auditing System UseAccessing Log Files from Programs |
|
The following sections include information that you need to access log files programmatically. When system logging is first enabled, MPE/iX creates and opens the first log file and begins recording events as they occur. When this log file is full, or when the system is shut down and restarted, MPE/iX creates and opens a new log file. Log file names always take the form LOGxxxx.PUB.SYS, where xxxx is the log file number, ranging from 0000 to 9999. The first log file is LOG000; when it is closed and a new log file opened, MPE/iX increments the file number by one. Each time a new log file is created, a console message, similar to the following, displays the new log file number:
Three MPE/iX commands, SHOWLOG, SWITCHLOG, and RESUMELOG, are available to control system logging. The SHOWLOG command displays the number of the current log files and the percentage of file space already used to record logging events. For example:
The SWITCHLOG command closes the current log file, and creates and opens a new one. The third command, RESUMELOG, restarts the logging process after it is suspended because of an error.
Log files are created by, and therefore belong to, the system logging process. By default, their creator is MANAGER.SYS. They are assigned the MPE/iX default security provisions typically assigned to files within the PUB group of the SYS account. The current log file can be modified only by users assigned Account Librarian (AL) capability for the SYS account, or by PUB group users (GU capability) of the SYS account. Once the log file is closed, MPE/iX changes the file access restrictions on the file from ANY to CR (the file creator) only. The result is that only the system manager controls access to current and closed log files. All log files are created as files containing variable-length records. They should always be treated as files containing variable-length records, accessed sequentially. For a log file, the end-of-file pointer can point at the last record (block) written to the file (if the file is closed normally), or at any point beyond the last record written (if the file has not been closed). In the latter case, all space following the last record is padded with zeros. The general format of a log file is shown in Figure 7-1 “Log File Format”. The log file record size is 2048 bytes with a maximum of 1024 records per file. Log file status and error messages are reported to the system console. They conform to the format hh/mm/PIN/message, where:
The log file status message text may consist of any of the following:
Log file errors are reported in one of the following messages. Refer to Table 7-1 “Log File Errors” for a summary of log file error numbers, their meaning, and whether they are recoverable or irrecoverable errors.
Two types of errors prevent the system logging facility from maintaining the log file:
When logging resumes, a special log record is created, denoting the total number of records missed, the number of job/session initiation records missed, the number of job/session termination records missed, and the number of I/O records missed. To analyze this or any other entry in the log file, run the LOGTOOL utility program.The following table shows the various file errors that are logged: Table 7-1 Log File Errors
|