Next: Notify
Up: Message Log
Previous: Change Log
The program flatten formats the message log file to allow it
to be more easily read and processed by a database management system
or by operating system utilities (sed, awk, etc.).
Flatten resides in the directory /usr/adm/sg. It reads the
free format records found in the Eagle log, reformats the records
in a fixed field format, and prints them on standard output. When completed,
it prints on standard error the number of records skipped due to badly
formed log messages.
In the output, each field is of variable width and is separated from the
next by one space. The last field is terminated by a newline
(ASCII linefeed). The description of the fields below are given in the
same order as they appear in the output.
- date
- The date of the log message is given in the form MM/DD/YYYY,
so that August 1, 1995 will show up as 08/01/1995.
- time
- The time of the log message is given in 24-hour clock style in
the form HH:MM:SS. Example, 08:15:01.
- service or program
- This tells what generated the message. If the ID
(described next) is zero, this is a program like gwcontrol or
passer. If ID is non-zero, it is a service like ftp or
telnet.
- ID
- This is the identification number of a connection if non-zero.
If zero, the message does not describe a connection.
- message level
- This tells at what severity level this message is.
Values are: Info, Notice, Warning, Error, Alert, Critical, Emergency, or
Unknown. Refer to Appendix
for a description
of these severity codes.
- message id
- This gives the unique message id number that every message
in the Eagle log file has. Example: 101 for Eagle Network
Security Management System starting up. See Appendix
for a
description of log messages.
- argument 1
-
- argument 2
-
- argument 3
-
- argument 4
-
- argument 5
- These five fields are variable parts of the log message
broken out into separate values. The values are different for each separate
message. An argument that is not used by the message will have a value of 0,
in order to keep the same number of fields on an output line. Only the
following message id's have any arguments:
- 105
- a1=incoming host, a2=outgoing host
- 106
- a1=traced host
- 201
- a1=incoming host, a2=outgoing host
- 310
- a1=host name, a2=host IP address
- 311
- a1=host name
- 312
- a1=host name
- 406
- a1=audio file name
- 417
- a1=host name, a2=port number
- 501
- a1=incoming host, a2=outgoing host
- 502
- a1=host name, a2=ethernet address
- 503
- a1=host name, a2=host IP address
- 605
- a1=program name
- log message (optional)
-
This field contains the entire text of the log message as
specified by ID. Note this field has a variable length and may
contain spaces. It is terminated with Newline character (ASCII
Linefeed). Use -n as a command line argument to exclude this
field from the flattened record.
Next: Notify
Up: Message Log
Previous: Change Log