Get a Free 30 Day Evaluation of Kanaka for Mac!

AuditLogin consists of 3 main components:

AuditLogin Consolidator

The consolidator (CONSLDAT.NLM) provides 2 main functions:

1. Receives auditing records via secured NCP transactions from systems running the System Monitoring NLM. These records are written to a file of the form YYYYMMDD.001 where YYYYMMDD is the year, month, and day that the transaction actually occurred. A single file is used for store data for an entire day. The NLM will periodically sort the data in these files based on a schedule set by the administrator. When the log file is sorted, it is renamed so that the extension is "000". Old logs are automatically purged based on criteria set by the administrator.

2. Services parameter read requests via secured NCP transactions to the Administrator and the System Monitoring NLMs. The consolidator performs several other housekeeping functions as well as keeping a running total of logging information for all servers.

AuditLogin System Monitoring

The system monitoring component (AUDITLGN.NLM) is the heart and soul of the system. It hooks login and logout system events and constantly monitors the connection table of the server it is running on. It maintains an unlicensed connection to the server running the consolidation server. When an event occurs on the server, the transaction is immediately sent to the consolidator via a secured NCP transaction. If for some reason the consolidator server is unreachable, the data will be stored locally until the consolidator is functioning again. At that time all locally stored data will be sent to the consolidator.

AuditLogin Administrator

The administrator is used to configure all AuditLogin parameters and install and maintain the System Monitoring NLM on remote servers. For more information, see the Configuration topic.