Configuring security audit notifications using scripting

Configure the security auditing system to send email notifications to a distribution list, system log, or both a distribution list and a system log if a failure occurs in the audit subsystem. Security auditing provides tracking and archiving of auditable events.

Before you begin

Before configuring a notification object in the audit.xml configuration file, verify that you set up a security auditing subsystem and configured the security auditing policy.

About this task

You can configure the security auditing system to notify a specific person or group when a failure occurs in the audit subsystem. Use the following steps to enable security auditing email notifications, set the format of notification email, and secure email:

Note: 這個主題參照一或多個應用程式伺服器日誌檔。 此外,在分散式和 IBM® i 系統上,另外也建議您可以配置伺服器來使用「高效能可延伸記載 (HPEL)」日誌和追蹤基礎架構,而不使用 SystemOut.logSystemErr.log, trace.logactivity.log 檔案。HPEL 與原生 z/OS® 記載機能也可以一起使用。如果您使用 HPEL,則可以從伺服器設定檔 bin 目錄,利用 LogViewer 指令行工具來存取您所有的日誌和追蹤資訊。請參閱有關利用 HPEL 疑難排解應用程式的資訊,以取得更多使用 HPEL 的相關資訊。

Procedure

  1. Launch the wsadmin scripting tool using the Jython scripting language. See the Starting the wsadmin scripting client article for more information.
  2. Customize and enable security auditing email notifications.
    Table 1. Command parameters. Use the createAuditNotification command and the following parameters to configure notifications:
    Parameter Description Data Types Required
    -notificationName Specifies a unique name to assign the audit notification object in the audit.xml file. String Yes
    -logToSystemOut Specifies whether to log the notification to the SystemOut.log file. Boolean Yes
    -sendEmail Specifies whether to email notifications. Boolean Yes
    -emailList Specifies the email address or email distribution list to email notifications. The format for this parameter is: admin@company.com(smtp-server.mycompany.com) String No
    -emailFormat Specifies whether to send the email be HTML or TEXT format. String No
    To create the audit notification object, you must specify the -notificationName, -logToSystemOut, and -sendEmail parameters, as the following example demonstrates:
    AdminTask.createAuditNotification('-notificationName defaultEmailNotification 
    -logToSystemOut true -sendEmail true -emailList administrator@mycompany.com(smtp-server.mycompany.com) 
    -emailFormat HTML')
  3. Create an audit notification monitor object.
    Create an audit notification monitor object to monitor the security auditing subsystem for possible failure.
    Table 2. Command parameters. Use the createAuditNotificationMonitor command and the following parameters to create a monitor object for the security auditing system:
    Parameter Description Data Types Required
    -notificationName Specifies a unique name to assign the audit notification object in the audit.xml file. String Yes
    -logToSystemOut Specifies whether to log the notification to the SystemOut.log file. Boolean Yes
    -sendEmail Specifies whether to email notifications. Boolean Yes
    -emailList Specifies the email address or email distribution list to email notifications. The format for this parameter is: admin@company.com(smtp-server.mycompany.com) String No
    -emailFormat Specifies whether to send the email be HTML or TEXT format. String No
    To create the audit notification monitor object, you must specify the -notificationName, -logToSystemOut, and -sendEmail parameters, as the following example demonstrates:
    AdminTask.createAuditNotificationMonitor('-notificationName defaultEmailNotification 
    -logToSystemOut true -sendEmail true -emailList administrator@mycompany.com(smtp-server.mycompany.com) 
    -emailFormat HTML')
  4. Save your configuration changes.
    請利用下列指令範例來儲存您的配置變更:
    AdminConfig.save()

Results

The security auditing system notifies the specified recipients if a failure occurs in the security auditing system.

What to do next

Use the modifyAuditNotification command and the Audit Notification Commands command group for the AdminTask object to manage your notification configuration.


指出主題類型的圖示 作業主題



時間戳記圖示 前次更新: July 9, 2016 11:18
http://www14.software.ibm.com/webapp/wsbroker/redirect?version=cord&product=was-nd-mp&topic=txml_7auditnotify
檔名:txml_7auditnotify.html