000025944 - How to read Logcsv files?

Document created by RSA Customer Support Employee on Jun 16, 2016Last modified by RSA Customer Support Employee on Apr 21, 2017
Version 2Show Document
  • View in full screen mode

Article Content

Article Number000025944
Applies ToLogcsv files
Automated Log Maintenance
IssueHow to read Logcsv files?
The user would like to know about the column headings in the reports generated using Automatic Audit Log Maintenance. The Logcsv files are created in the ace/data directory and have 17 fields. Each field is separated by a comma. The headings for these fields are not mentioned in the Administration Manual.
ResolutionThe column headings are:

1. Log Entry Number - An internal database index used to uniquely represent
this log.
2. GMT Date - GMT/UTC date of the event.
3. GMT Time - GMT/UTC time of the event.
4. Local Date - Local date of the event.
5. Local Time - Local time of the event.
6. Message Number - Numeric code that represents the event.
7. User Name - First and last names of the user involved in the event.
8. Login - Login ID of the User involved in the event.
9. Token Serial Number - SN of the token involved in the event.
10. Site Name - Name of the site the group belongs to.
11. Group Name - Name of the group of which the user is a member.
12. Client Name - Name of the client the user logs in to.
13. Server Name - Name of the server where the event takes place or where the
user's authentication information is processed.
14. Affected User Name - Name of the user affected by the action of this event.
15. PID - Not used.
16. Minor Error - Error code that indicates the internal DB failure.
17. Message Text - A short description of the event.

Example file:

Here is an excerpt out of the logcsv.1 file and a brief description of each field:

1096724,10/26/1998,18:14:44,10/26/1998,13:14:44,3000,"jsmith","jsmith","","","","","jsmith_pc.securitydynamics.com","",0,0,"Sdadmin Started"

1096724 is a process id number
The date and UTC time
The date and local time
3000 refers to a job number - 3000 will always refer to "Sdadmin Started"
The name of client
The job name ("Sdadmin Started")

Each record in a field has a specific format. For detailed description of the format see Record Format in Logcsv File
NotesSee A41682 for a similar solution for AM7.1
Legacy Article ID6.0.3209636.2905594