Auditing the SDCS logs on an Access Appliance

There are several ways to audit the SDCS logs on a Veritas Access Appliance node.

Basic search

To do a basic SDCS log search

Log on to the Access Appliance shell menu.
From the Main_Menu > Monitor > SDCS view, enter the following command:
Audit Search <term>
Where <term> is a word or name that you want to search in the logs for.

Filter by individual attribute

SDCS events have three main attributes:

You can filter the SDCS logs by each individual attribute.

To filter SDCS log entries by date

Log on to the Access Appliance shell menu.
Go to the Main_Menu > Monitor > SDCS view.
(Optional) Enter the following command to view all of the events that occurred on a specific day:
Audit View Date <ToDate>
Where <ToDate> is the day in the DD/MM/YYYY format.
(Optional) Enter the following command to view all of the events that occurred during a specific period of time:
Audit View Date <ToDate>[-hh:mm:ss] [<FromDate>[-hh:mm:ss]]
Where <ToDate>[-hh:mm:ss] is the later date/time and [<FromDate>[-hh:mm:ss]] is the earlier date/time. For example:
Audit View Date 05/25/2016-13:00:00 05/25/2016-12:00:00

To filter SDCS log events by severity

Log on to the Access Appliance shell menu.
From the Main_Menu > Monitor > SDCS view, enter the following command:
Audit View Severity <SeverityCode>
Where <SeverityCode> is the one letter code of the severity type that you want to filter by.
See About SDCS event type codes and severity codes on an Access appliance node.

To filter SDCS log entries by type

Log on to the Access Appliance shell menu.
From the Main_Menu > Monitor > SDCS view, enter the following command:
Audit View EventType <TypeCode>
Where <TypeCode> is the four letter code of the event type that you want to filter by.
See About SDCS event type codes and severity codes on an Access appliance node.

Filter using multiple attributes

The best way to search for a specific type of SDCS event from a particular period of time is to use the Audit View Filter command.

To filter SDCS log entries by date

Log on to the Access Appliance shell menu.
From the Main_Menu > Monitor > SDCS view, enter the following command:
Audit View Filter <SeverityCode> <TypeCode> <ToDate>[-hh:mm:ss] [<FromDate>[-hh:mm:ss]] <Search_yes/no>
- <SeverityCode>
  The one letter code of the severity type that you want to filter by. Enter ALL if you want to include all severity codes in your filter.
- <TypeCode>
  The four letter code of the event type that you want to filter by. Enter ALL if you want to include all event type codes in your filter.
- <ToDate>[-hh:mm:ss] [<FromDate>[-hh:mm:ss]]
  Where <ToDate>[-hh:mm:ss] is the later date/time and [<FromDate>[-hh:mm:ss]] is the earlier date/time. Use the DD/MM/YYYY date format.
  To filter events for a specific day, use <ToDate>[-hh:mm:ss] and type NULL for [<FromDate>[-hh:mm:ss]].
  To filter all events after a specific date/time, use [<FromDate>[-hh:mm:ss]] and type NULL for <ToDate>[-hh:mm:ss]
- <Search_yes/no>
  Enter yes if you want to include a search term. Otherwise, enter no.
For example:
Audit View Filter C ALL 05/26/2016-14:00:00 05/25/2016-13:00:00 no
(Optional) If you entered yes for <Search_yes/no>, enter the search string when prompted.

Get more details about an event

You can use the Audit View EventID command to get more information about a specific SDCS event that is listed in a search or filter.

To get more details about a specific SDCS event

Log on to the Access Appliance shell menu.
From the Main_Menu > Monitor > SDCS view, enter the following command:
Audit View EventID <ID#>
Where <ID#> is the ID number of an event that was listed in your filter or search.

More Information