Log file rolling results in multiple active log files in VigilEnt Security Agent for WebServers. (NETIQKB31835)

fact
VigilEnt Security Agent for WebServers

symptom
Log file rolling results in multiple active log files in VigilEnt Security Agent for WebServers.

cause
This is a known issue within the product. Log file rolling, available for System and Transaction log files of Detect/Prevent, does not function correctly when roll frequency is set to a value greater than one.

fix

To work around this problem, set the roll method to ROLL_BY_DAY or ROLL_BY_HOUR and set the roll frequency to one (1) in the Detect/Prevent settings.

To edit the roll frequency, follow these steps:

1. Click the Detect/Prevent tab in the main VigilEnt Security Agent for WebServers window. The Detect/Prevent window opens.

2. Select Manage Web Servers on the sub-navigation bar. The Web Server Manager window opens, listing all web server configurations that have been added.

3. Click the Edit Actions icon next to the configuration to be edited. The Action Editor window opens.

   • Roll Method: Entries in Roll Method and Roll Frequency are used to determine how often new log files are started. In Roll Method, select the base time interval to be used to determine when new logs are started.

   • Roll Frequency: This entry is used with the entry in Roll Method; for example, set Roll Method to ROLL_BY_HOUR and Roll Frequency to 12 to start new logs twice each day. (Note: This is the way the product was intended to work, please use work around in its place.)

4. Click Save.

Note: If a configuration is listed as active in Web Server Manager, the Action Editor can be accessed using the Edit Actions link on the sub-navigation bar. Links to all actions for the selected configuration are listed in the navigation pane on the left side of the screen.

note
When a web server is restarted or spawns a new process, the new process is created with a log file rolling interval based on the beginning of the current minute/hour/day (depending upon the roll method selected). This may result in the creation of multiple active log files when the rolling frequency is set to a value greater than one.

Formerly known as NETIQKB31835