ReportAgent
In the [ReportAgent] section, the tokens control the behavior of the Report Agent daemon (ReportAgent).
capamsc141
In the [ReportAgent] section, the tokens control the behavior of the Report Agent daemon (ReportAgent).
- audit_enabledSpecifies whether you want to send endpoint audit data to the Distribution Server.Values:0no;1yesDefault:0
- audit_filterDefines the full pathname to the file that contains filtering rules for audit records that the Report Agent routes to an external source (such as the Audit Log). This file determines which records the Report Agent routes.Default:ACSharedDir/etc/auditrouteflt.cfg
- audit_queueDefines the name of the queue to which the Report Agent sends endpoint audit data.Default:queue/audit
- audit_read_chunkDefines the maximal audit records the Report Agent tries to collect in a single read of the audit files.Limits:A positive integerDefault:300
- audit_send_chunkDefines the maximal audit records that the Report Agent sends to the Distribution Server in each connection. When the number of audit records the Report Agent collects reaches this number, it sends these records to the Distribution Server.Limits:A positive integerDefault:1800
- audit_sleepDefine the length of time the Report Agent sleeps between generating audit reports.Limits:A positive integer representing a number of secondsDefault:10
- audit_timeoutDefines the cycle at which the Report Agent must send endpoint audit data to the Distribution Server. If this amount of time passes from the last send, the Report Agent sends audit data to the Distribution Server. The Report Agent sends this data even if the number of records it collected is less than the audit_send_chunk value.Limits:A positive integer representing a number of secondsDefault:300
- DebugSpecifies whether the Report Agent logs debug information.If you specify yes (1), the Report Agent logs the following reports:
- PAM Server Controlreports toACSharedDir/log/ac2xml.log
- UNAB reports (uxauthd) toACSharedDir/log/unab2xml.log
- PAM Server Controlaudit reports that are sent to the Audit Log toACSharedDir/log/ac2elm.log
- UNAB audit reports that are sent to the Audit Log toACSharedDir/log/unab2elm.log
- Keyboard Logger reports that are sent to the Audit Log toACSharedDir/log/kbl2elm.log
Limits:0, Report Agent does not log debug information; 1, Report Agent logs debug informationDefault:0 - elm_event_intervalDefines the interval in seconds, at which the Report Agent sends user sessions audit events to the Audit Log.Limits: 0; no interval, send audit events when messages size exceeds the value specified in the elm_max_msg_size token; any positive integer.Default: 60
- elm_max_msg_sizeDefines the maximum size of Keyboard Logger messages, in bytes, that the Report Agent sends to the Audit Log.Value: Any positive integerDefault: 300000
- intervalDefines the interval, in minutes, at whichPAM Server Controlgenerates and sends reports to the Distribution Server.Theschedulesetting defines the interval start time and the days it operates on. If the Report Agent starts later than a scheduled occurrence, it sends a report at the next calculated interval (from the schedule) and then at the defined intervals after that on scheduled days.Example:If you have schedule=8:30@Mon,Tue, Wed, and interval=5 and the Report Agent loads on Tuesday at 8:47 am, the Report Agent generates and sends a report at 8:50 am. This is the earliest cycle calculated from the scheduled start using the 5-minute interval.Values:0 No interval (use scheduled occurrences only);positive integernumber of minutes to use as intervalDefault:0
- reportagent_enabledSpecifies whether reporting is enabled (1) on the local computer.Default:0
- scheduleDefines when reports are generated and sent to the Distribution Server.You specify this setting in the following format: time@day[,day2][...]For example, "19:22@Sun,Mon" generates reports every Sunday and Monday at 7:22 pm.Default:00:00@Sun,Mon,Tue,Wed,Thu,Fri,Sat
- send_queueDefines the name of the reporting queue on the Distribution Server to which the Report Agent sends snapshots of the local database and any PMDBs.Default:queue/snapshots
- restart_enabledSpecifies restart of the ReportAgent daemon. Specify 1 to enable the restart.Default: 0