Adapter Files
The UNIX log file adapter package consists of the following files:
tecad_logfile.cfg
The installation script.
init.tecad_logfile
The adapter startup and shutdown script. Never stop the adapter
using signals. Use this script to ensure that the syslogd daemon
remains running and functional.
tecad_logfile The executable file of the adapter that receives the log information
and transforms it into events.
logfile_gencds
The executable file that converts a format file to a CDS file.
tecad_logfile.baroc
The BAROC file.
tecad_logfile.cds
The CDS file. This file is created by running logfile_gencds on the
format file.
tecad_logfile.conf
The configuration file.
tecad_logfile.err
The error file.
tecad_logfile.fmt
The format file.
log_default.rls
The default rule file.
Before you start the event server and UNIX log file adapter, check each adapter file
to determine if it defines the behavior you want from the adapter.
Configuration File
The configuration file defines the behavior of the adapter. The configuration file
can have the common keywords described in “Configuration File” on page 9, as
well as the following custom keywords:
LogSources
Specifies the log files to poll. The complete path to each file must be
specified, and file names must be separated by commas; no spaces or other
separators can be used. A log source need not exist when the adapter is
started; it will be polled when it is created.
If a file truncates while the adapter is active, the adapter automatically
resets its internal pointer to the beginning of the file. If during the polling
interval the file is overwritten, removed, or recreated with more lines than
the previous poll, only the number of lines greater than the previous line
count is read. For example, the file has one line. After the poll interval
elapses, the file is overwritten with two lines. Only the second line is read
on the next polling.
Note: The maximum number of lines that can be concatenated to a log file
is 16 384.
Chapter 9. UNIX Log File Adapter 103