Log File/Audit File Rollover - HP NonStop SSH 544701-014 Reference Manual

Event Event
Id Name

Log File/Audit File Rollover

When logging to a file, SSH2 uses a round-robin mechanism to switch to a new file. Log file rollover applies both to
auditing (to the file configured with the AUDITFILE parameter) and logging (to the file configured with the LOGFILE
parameter).
A log file rollover occurs when the logfile is greater than the size configured in the parameter LOGMAXFILELENGTH
or when the audit file is greater than the size configured in the parameter AUDITMAXFILELENGTH. It is also possible
to force the rollover via SSHCOM command (see ROLLOVER AUDITFILE and ROLLOVER LOGFILE in chapter
"SSHCOM Command Reference".
SSH2 implements a log file round-robin with at least 10 files. The number of files can be configured using the
LOGFILERETENTION (or AUDITFILERETENTION) parameter. If the number of retention files is set to 0
(LOGFILERETENTION or AUDITFILERETENTION), then the content of file configured via LOGFILE (or
AUDITFILE) will be purged as soon as the file size reaches the maximum configured size. But it is recommended to use
at least 10 retention files.
Archive files generated during rollover will be created by appending a number to the log file name. The number of digits
of the number appended will be calculated depending on the number of files to keep.
With LOGFILERETENTION set to 10 (the default value), the archive files for a LOGFILE of SLOG will be called
SLOG0, SLOG1, ... SLOG9.
With LOGFILERETENTION set to 1000, the archive files for a LOGFILE of SLOG will be called SLOG000,
SLOG001, ... SLOG999.
HP NonStop SSH Reference Manual
Conditions Pattern Token Values
%action: 'terminate'
%object: 'SFTP process'
%errInfo: error detail
%processType: 'SFTPSERV'
%processName: process name
Monitoring and Auditing • 293