Audit Trail Targets

This setting specifies how to calculate where the system sends the audit trail information for a particular component if you have also set the corresponding Audit Trail Overrides setting.

There are two kinds of audit trail targets that can be specified:

  • Whether to enable the DirectAudit audit trail target for the component or not
  • Whether to enable the local logging system audit trail target or not. On UNIX systems, the local logging system is syslog and on Windows systems it's the Windows event log.

For this setting, you specify a single numeric value to represent which audit trail targets are enabled for the component. (Setting one value to signify two settings is called a bit mask.) The possible settings are as follows:

Value Enable the DirectAudit audit trail target for the component? Enable the local logging audit trail target for the component? Description
0

No

No

Neither the DirectAudit nor the local logging target are enabled for the component.

This is the default setting for the group policy

1

Yes

No

Enable only the DirectAudit audit trail target for the component.

This capability is supported by DirectAudit version 3.2 and later.

2

No

Yes

Enable only the local logging audit trail target for the component.

3

Yes

Yes

Enable the audit trail targets for both DirectAudit and the local logging system.

The system calculates the final audit trail targets for a component based on the following information:

  • If the Audit Trail Targets Override is not specified, the system uses the global audit trail target value
  • If Audit Trail Targets Override is specified, for each target (DirectAudit and local logging), whether the audit trail information will be sent to this target is determined by the following:
    • If the setting is not overridden in with Audit Trail Targets Override, the system uses the global audit trail target value
    • If the target is overridden by Audit Trail Targets Override and enabled by Audit Trail Targets, the system sends the audit trail information to this target

This group policy modifies the audittrail.<product>.<component>.targets settings in the agent configuration file. Each category has its own setting in that file.