ReportAgent

In the [ReportAgent] section, the tokens control the behavior of the Report Agent daemon (ReportAgent).
capamsc141
In the [ReportAgent] section, the tokens control the behavior of the Report Agent daemon (ReportAgent).
  • audit_enabled
    Specifies whether you want to send endpoint audit data to the Distribution Server.
    Values:
    0
    no;
    1
    yes
    Default:
    0
  • audit_filter
    Defines the full pathname to the file that contains filtering rules for audit records that the Report Agent routes to an external source (such as the Audit Log). This file determines which records the Report Agent routes.
    Default:
    ACSharedDir
    /etc/auditrouteflt.cfg
  • audit_queue
    Defines the name of the queue to which the Report Agent sends endpoint audit data.
    Default:
    queue/audit
  • audit_read_chunk
    Defines the maximal audit records the Report Agent tries to collect in a single read of the audit files.
    Limits:
    A positive integer
    Default:
    300
  • audit_send_chunk
    Defines the maximal audit records that the Report Agent sends to the Distribution Server in each connection. When the number of audit records the Report Agent collects reaches this number, it sends these records to the Distribution Server.
    Limits:
    A positive integer
    Default:
    1800
  • audit_sleep
    Define the length of time the Report Agent sleeps between generating audit reports.
    Limits:
    A positive integer representing a number of seconds
    Default:
    10
  • audit_timeout
    Defines the cycle at which the Report Agent must send endpoint audit data to the Distribution Server. If this amount of time passes from the last send, the Report Agent sends audit data to the Distribution Server. The Report Agent sends this data even if the number of records it collected is less than the audit_send_chunk value.
    Limits:
    A positive integer representing a number of seconds
    Default:
    300
  • Debug
    Specifies whether the Report Agent logs debug information.
    If you specify yes (1), the Report Agent logs the following reports:
    • PAM Server Control
       reports to
      ACSharedDir
      /log/ac2xml.log
    • UNAB reports (uxauthd) to
      ACSharedDir
      /log/unab2xml.log
    • PAM Server Control
       audit reports that are sent to the Audit Log to
      ACSharedDir
      /log/ac2elm.log
    • UNAB audit reports that are sent to the Audit Log to
      ACSharedDir
      /log/unab2elm.log
    • Keyboard Logger reports that are sent to the Audit Log to
      ACSharedDir
      /log/kbl2elm.log
    Limits:
    0, Report Agent does not log debug information; 1, Report Agent logs debug information
    Default:
    0
  • elm_event_interval
    Defines the interval in seconds, at which the Report Agent sends user sessions audit events to the Audit Log.
    Limits
    : 0; no interval, send audit events when messages size exceeds the value specified in the elm_max_msg_size token; any positive integer.
    Default
    : 60
  • elm_max_msg_size
    Defines the maximum size of Keyboard Logger messages, in bytes, that the Report Agent sends to the Audit Log.
    Value
    : Any positive integer
    Default
    : 300000
  • interval
    Defines the interval, in minutes, at which 
    PAM Server Control
    generates and sends reports to the Distribution Server.
    The
    schedule
    setting defines the interval start time and the days it operates on. If the Report Agent starts later than a scheduled occurrence, it sends a report at the next calculated interval (from the schedule) and then at the defined intervals after that on scheduled days.
    Example:
    If you have schedule=8:30@Mon,Tue, Wed, and interval=5 and the Report Agent loads on Tuesday at 8:47 am, the Report Agent generates and sends a report at 8:50 am. This is the earliest cycle calculated from the scheduled start using the 5-minute interval.
    Values:
    0 No interval (use scheduled occurrences only);
    positive integer
    number of minutes to use as interval
    Default:
    0
  • reportagent_enabled
    Specifies whether reporting is enabled (1) on the local computer.
    Default:
    0
  • schedule
    Defines when reports are generated and sent to the Distribution Server.
    You specify this setting in the following format: time@day[,day2][...]
    For example, "19:22@Sun,Mon" generates reports every Sunday and Monday at 7:22 pm.
    Default:
    00:00@Sun,Mon,Tue,Wed,Thu,Fri,Sat
  • send_queue
    Defines the name of the reporting queue on the Distribution Server to which the Report Agent sends snapshots of the local database and any PMDBs.
    Default:
    queue/snapshots
  • restart_enabled
    Specifies restart of the ReportAgent daemon. Specify 1 to enable the restart.
    Default
    : 0