Novell NSS Audit

2.3 VLOG

1.0 Introduction

The NSS file system audit framework enables applications to be tracked and to log all file and directory access events. Auditing facilitates the process of monitoring NSS file system activities to ensure that transactions are accurate and that confidential information is secure. It monitors events from all protocols, such as NCP, Novell AFP, and Novell CIFS.

2.0 What’s New

This section provides a summary of changes to the NSS Audit functions.

2.1 New Event Types Generated in OES2015

New events are introduced to incorporate Active Directory identities, and structures for these new events have been modified. Existing tools will not work with these new structure changes on OES 2015. You must incorporate the latest changes from the vigil.h file.

2.1.1 NetWare Core Protocol(NCP) bit-events

#define VIGIL_E_NCP_OPEN_2                   0x00001000
#define VIGIL_E_NCP_CLOSE_2                  0x00002000

2.1.2 Novell Storage Services (NSS) bit-events

#define VIGIL_E_NSS_DELETE_2                 0x00001000
#define VIGIL_E_NSS_CREATE_2                 0x00002000
#define VIGIL_E_NSS_OPEN_2                   0x00004000
#define VIGIL_E_NSS_CLOSE_2                  0x00008000
#define VIGIL_E_NSS_RENAME_2                 0x00010000
#define VIGIL_E_NSS_LINK_2                   0x00020000
#define VIGIL_E_NSS_MODIFY_2                 0x00040000
#define VIGIL_E_NSS_ADDTRUSTEE_2             0x00080000
#define VIGIL_E_NSS_REMOVETRUSTEE_2          0x00100000
#define VIGIL_E_NSS_SETINHERITEDRIGHTS_2     0x00200000
#define VIGIL_E_NSS__CNT                     20

2.1.3 Common Internet File System (CIFS) services bit-events

#define VIGIL_E_CIFS_OPEN_2                  0x00000100
#define VIGIL_E_CIFS_CLOSE_2                 0x00000200

2.2 Events Deprecated in OES 2015

The following events are deprecated in OES 2015. However, these events are valid for previous version of OES.

NCP:
   
   #define VIGIL_E_NCP_OPEN                     0x00000010
   #define VIGIL_E_NCP_CLOSE                    0x00000020
   
NSS: 
   #define VIGIL_E_NSS_DELETE                   0x00000001
   #define VIGIL_E_NSS_CREATE                   0x00000002
   #define VIGIL_E_NSS_OPEN                     0x00000004
   #define VIGIL_E_NSS_CLOSE                    0x00000008
   #define VIGIL_E_NSS_RENAME                   0x00000010
   #define VIGIL_E_NSS_LINK                     0x00000020
   #define VIGIL_E_NSS_MODIFY                   0x00000040
   #define VIGIL_E_NSS_ADDTRUSTEE               0x00000080
   #define VIGIL_E_NSS_REMOVETRUSTEE            0x00000100
   #define VIGIL_E_NSS_SETINHERITEDRIGHTS       0x00000200      

CIFS:
   #define VIGIL_E_CIFS_OPEN                    0x00000001
   #define VIGIL_E_CIFS_CLOSE                   0x00000002

2.3 VLOG

TrusteeId attribute in the VlOG output supports Active Directory and eDirectory users. An “S” in the TrusteeId value indicates that it is an Active Directory SID. The TrusteeDN attribute in the VLOG output supports both Active Directory and eDirectory domain names. An Active Directory domain name will be in the format “domain\sAMAccountName”.

NOTE: In a pure eDirectory environment, there is no change in the output format for VLOG customers.

3.0 Additional Information

For specific details about this component, please refer to any readme or documentation that is included in the component download.

4.0 Legal Notices

Novell, Inc. makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc. makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the trade laws of other countries. You agree to comply with all export control regulations and to obtain any required licenses or classification to export, re-export, or import deliverables. You agree not to export or re-export to entities on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses. Please refer to http://www.novell.com/info/exports/ for more information on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export approvals.

All files provided in this release are subject to the Novell Developer License Agreement, which can be found in the license.txt file provided in this download.

Copyright © 2003-2015 Novell, Inc. All rights reserved. No part of this publication may be reproduced, photocopied, stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc. has intellectual property rights relating to technology embodied in the product that is described in this document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S. patents listed at http://www.novell.com/company/legal/patents/ and one or more additional patents or pending patent applications in the U.S. and in other countries.