Log Management

[tom.ashworth]

Running ACS 4.2 Solution Engine with a primary/secondary in two different geographical locations. Have a question revolving around log management (or lack of). We have decided to use CSV logging for Failed Attempts. When I configure that report I do not see the log management options under the select columns section. Looking through the configuration guides I found a small blurb stating that it was only available on Windows and remote agent logging. So how does the Solution Engine logging work then? All entries just go into one big file? Does that file at some point over write itself? With CSV logging on the solution engine is there any way to control the logs and frequency of generation? I realize a syslog server would be the better option but do not have the alternative available currently.

Thanks,

Tom

[darpotter · Accepted solution]

Im afraid the SE has a hard coded 10MB rollover limit.

You cant do daily rollover.

Take a look at extraxi aaa-reports! Our csvsync http client can pull down the active (unrolled) log as often as you like and aaa-reports! itself has duplication detection so the same row never gets imported twice.

With that in place it then doesnt matter about lack of management on the ACS server.

Also, as logs eventually do roll they get downloaded by csvsync so you have have backup copies of everything that got logged ready for archiving. This is all easily automated so you can stop thinking about it!

[tom.ashworth]

Thank you for your reply. You confirmed what I had suspected.

Tom

[Mason Tu]

I got the same problem in SE 4.2.

All data are stored in one file and we have to download the file and separate it by date.

Is there any way to achieve the same function as ACS for windows(Generate new file every day)?

[darpotter]

Unfortunately not.

The original ACS appliance had a smallish HDD and I think the choice to hard code log file management came from that which was a shame. extraxi csvsync can be used to grab a daily snapshot of the active logs (in case they are taking days or weeks to rollover) and pull down any new rolled logs.

If you import into extraxi aaa-reports! we offer full de-duping so the same active csv can be imported multiple times with only the newest rows being imported each time.

60 day working trial from http://www.extraxi.com