OES2 stops sending NSS audit events to Sentinel server

  • 7009667
  • 31-Oct-2011
  • 27-Apr-2012

Environment

Novell Audit
Novell Open Enterprise Server 2 (OES 2) Linux
Novell Sentinel 6.1
vlog
sentagent
Novell Storage Services (NSS)

Situation

  • Sentinel not logging OES2 NSS events
  • OES2 servers stop sending events to Sentinel servers
  • Sentinel server stops receiving events from OES2 servers
  • Files start accumulating/building up/stacking in /var/log/audit/vlog/SENTINEL
  • Multiple SENTINEL_*.log files e.g.  SENTINEL_000000004EAE753F_068238.log

Resolution

  • Add the -Q parameter to /usr/local/sbin/sentsubagent.conf
    • vlog /opt/novell/vigil/bin/vlog --v2sent -Q -F /usr/local/sbin/vlogfilters

  • Restart sentagent
    • /etc/init.d/sentagent restart

Additional Information

By default vlog ignores stdin commands, so if flow control is required, the -Q option needs to be specified on the command line along with the -v2sent option.  vlog then creates a pthread in which it processes "Start/Stop processing events" and accordingly starts or stops sending vlog events.

Feedback service temporarily unavailable. For content questions or problems, please contact Support.