User manual NOVELL IDENTITY MANAGER 3.6. INTEGRATION

[. . . ] novdocx (en) 11 July 2008 AUTHORIZED DOCUMENTATION Integration Guide For Novell Audit Novell® 3. 6 July 23, 2008 Identity Manager www. novell. com Identity Manager 3. 6 Integration Guide for Novell Audit novdocx (en) 11 July 2008 Legal Notices Novell, Inc. , makes no representations or warranties with respect to the contents or use of this documentation, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to revise this publication and to make changes to its content, at any time, without obligation to notify any person or entity of such revisions or changes. Further, Novell, Inc. , makes no representations or warranties with respect to any software, and specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc. , reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to notify any person or entity of such changes. [. . . ] You can configure the size of this field in the LogMaxBigData value in logevent. cfg. This value does not set the size of the Data field, but it does set the maximum size that the Platform Agent can log. For more information, see Chapter 3, "Installing and Configuring the Platform Agent, " on page 13. The maximum size of the Data field is defined by the database where the data is logged, so the size varies for each database that is used. If the size of the Data field logged by the Platform Agent exceeds the maximum size allowed by the database, the channel driver truncates the data in the Data field. If an event has more data than can be stored in the String and Numeric value fields, it is possible to store up to 3 KB of binary data in the Data field. 6 Click OK to return to the Policy Builder to construct the remainder of your policy. For more information and examples of the Generate Event action, see "Generate Event" in the Policies in Designer 3. 0 guide. 4. 2. 2 Using Status Documents to Generate Events Status documents generated through style sheets using the <xsl:message> element are sent to Novell Audit with an event ID that corresponds to the status document level attribute. The level attributes and corresponding event IDs are defined in the following table: Table 4-2 Status Documents Status Level Status Event ID Success Retry Warning Error Fatal User Defined EV_LOG_STATUS_SUCCESS (1) EV_LOG_STATUS_RETRY (2) EV_LOG_STATUS_WARNING (3) EV_LOG_STATUS_ERROR (4) EV_LOG_STATUS_FATAL (5) EV_LOG_STATUS_OTHER (6) The following example generates an event 0x004 and value1=7777, with a level of EV_LOG_STATUS_ERROR: <xsl:message> <status level="error" text1="This would be text1" value="7777">This data would be in the blob and in text 2, since no value is specified for text2 in the attributes. </status> </xsl:message> 24 Identity Manager 3. 6 Integration Guide for Novell Audit novdocx (en) 11 July 2008 The following example generates a Novell Audit event 0x004 and value1=7778, with a level of EV_LOG_STATUS_ERROR: <xsl:message> <status level="error" text1="This would be text1" text2="This would be text2" value1="7778">This data would be in the blob only for this case, since a value for text2 is specified in the attributes. </status> </xsl:message> 4. 3 eDirectory Objects that Store Identity Manager Event Data The Identity Manager events you want to log are stored in the DirXML-LogEvent attribute on the driver set or the driver. The attribute is a multi-value integer with each value identifying an event ID to be logged. You do not need to modify these attributes directly, because these objects are automatically configured based on your selections in iManager. Before logging an event, the engine checks the current event type against the contents of the DirXML-LogEvent attribute to determine whether the event should be logged. Drivers can inherit log settings from the driver set. The DirXML-DriverTraceLevel attribute of a driver has the highest precedence when determining log settings. If a driver does not contain a DirXML-DriverTraceLevel attribute, the engine uses the log settings from the parent driver set. Managing Identity Manager Events 25 novdocx (en) 11 July 2008 26 Identity Manager 3. 6 Integration Guide for Novell Audit novdocx (en) 11 July 2008 5 Using Status Logs In addition to the functionality provided by Novell® Audit, Identity Manager logs a specified number of events on the driver set and the driver. These status logs provide a view of recent Identity Manager activity. After the log reaches the set size, the oldest half of the log is permanently removed to clear room for more recent events. Therefore, any events you want to track over time should be logged to Novell Audit. The following sections contain information on the Identity Manager logs: Section 5. 1, "Setting the Log Level and Maximum Log Size, " on page 27 Section 5. 2, "Viewing Status Logs, " on page 29 5 5. 1 Setting the Log Level and Maximum Log Size Status logs can be configured to hold between 50 and 500 events. This setting can be configured for the driver set to be inherited by all drivers in the driver set, or configured for each driver in the driver set. The maximum log size operates independently of the events you have selected to log, so you can configure the events you want to log for the driver set, then specify a different log size for each driver in the set. This section reviews how to set the maximum log size on the driver set or an individual driver: Section 5. 1. 1, "Setting the Log Level and Log Size for the Driver Set, " on page 27 Section 5. 1. 2, "Setting the Log Level and Log Size for the Driver, " on page 28 5. 1. 1 Setting the Log Level and Log Size for the Driver Set 1 In iManager, select Identity Manager > Identity Manager Overview. 3 Click the driver set name to access the driver set overview page. [. . . ] Occurs upon failure of the step during the provisioning step. Occurs on granting of an entitlement during the provisioning step. Occurs on the revoking of an entitlement during the provisioning step. Novell Audit Reports 47 novdocx (en) 11 July 2008 Figure B-3 Resource Provisioning Report B. 4 Specific User Audit Trail Report I The Specific User Audit Trail Report I is generated from the events listed in the following table. For more information on the events, see Appendix A, "Identity Manager Events, " on page 39. 48 Identity Manager 3. 6 Integration Guide for Novell Audit novdocx (en) 11 July 2008 Table B-4 User Audit Trail Events Event ID Description Trigger 31520 31521 31522 31523 31524 31525 31526 31527 31528 31529 3152A 3152B 31533 Workflow_Error Workflow_Started Workflow_Forwarded Workflow_Reassigned Workflow_Approved Workflow_Refused Workflow_Ended Workflow_Claimed Workflow_Unclaimed Workflow_Denied Workflow_Completed Workflow_Timedout Workflow_Retracted Occurs when there is a workflow error. [. . . ]