Use Delimiters in a File-Based Audit Log

Integration Server 10.11 | Audit Logging Guide | Setting Up IS Core Audit Logging | Use Delimiters in a File-Based Audit Log

The fields for an entry in a file-based audit log can be fixed length or character delimited. By default, Integration Server uses fixed-length fields where the size of the fields determines the length of the fields. For each log entry, Integration Server writes the maximum number of characters for each field. If the actual data for the field is less than the defined size, then Integration Server pads the field with whitespace. This helps to maintain constant field widths which results in a log file with a human-readable format. However, when a log file has a large volume of entries, the fixed-length fields can quickly consume disk resources. To address this resource inefficiency, you can change the audit loggers to write character-delimited log entries instead of fixed length.

Integration Server includes the following server configuration parameters that you can use to specify the field and record delimiters for entries in a file-based audit log:

watt.server.audit.file.fieldDelimiter. Specifies the character sequence to delimit fields within a log record in a file-based audit log.

watt.server.audit.file.recordDelimiter. Specifies the character sequence to delimit records in a file-based audit log.

Keep the following information in mind when setting character delimiters for fields and records for file-based audit logs.

The watt.server.audit.file.fieldDelimiter and watt.server.audit.file.recordDelimiter parameters affect all audit logs written to a file including the FailedAudit log. The parameters do not affect audit logs written to a database.

There is no default value for the watt.server.audit.file.fieldDelimiter and watt.server.audit.file.recordDelimiter parameters. If no value is specified for the parameters, Integration Server writes log entries using the fixed-length format where each field is the maximum length.

A valid delimiter is any character sequence where a character is any visible (printing) character (0021-007E) from the US ASCII character set.

The values for watt.server.audit.file.fieldDelimiter and watt.server.audit.file.recordDelimiter must be different.

Integration Server writes character-delimited audit log entries only if both watt.server.audit.file.fieldDelimiterandwatt.server.audit.file.recordDelimiter are set to valid values and the values are different. If the values are not valid and are not different, Integration Server uses the fixed-length format for the file based audit logs.

When specifying delimiter character sequences, do not use a character sequence likely to appear in a log entry.

Whether a file-based audit log uses a fixed-length format or uses a character-delimited format does not affect how Integration Server Administrator displays the log file.

After switching between fixed-length format and character-delimited format, Integration Server Administrator cannot display entries from the previous format.

You must restart Integration Server for changes to the watt.server.audit.file.fieldDelimiter and watt.server.audit.file.recordDelimiter to take effect.

To revert to fixed-length field entries for file-based audit logs, delete the values of the watt.server.audit.file.fieldDelimiter and watt.server.audit.file.recordDelimiter parameters and restart Integration Server.