• Article

How to Enable Event Logging and ACS Rules on Solaris and AIX Computers

 

Updated: May 13, 2016

Applies To: System Center 2012 R2 Operations Manager, System Center 2012 - Operations Manager, System Center 2012 SP1 - Operations Manager

This topic does not apply to Windows computers.

By default, Solaris and AIX computers do not log audit events. The logging configuration is controlled by the file located at /etc/syslog.conf. You must make edits to this file and then enable ACS rules.

To Configure the Solaris Syslog

  1. Add the following code to the syslog.conf file:

    auth.info;local2.info /var/log/authlog

    Note

    Use the TAB key to separate log components from the log file names. Spaces do not work.

  2. Restart the Syslog daemon.

  3. On Solaris 5.8 and 5.9, enter the following commands:

     /etc/init.d/syslog stop

    /etc/init.d/syslog start

    On Solaris 5.10, enter the following commands:

    svcadm refresh svc:/system/system-log

You now must enable the ACS rules.

To Configure the AIX Syslog

  1. Add the following code to the syslog.conf file:

    *.info /var/log/syslog.log rotate size 1m files 10

    The Syslog file is rotated when it becomes larger than 1 megabyte (MB) and the number of rotated files is limited to 10.

    Note

    Use the TAB key to separate log components from the log file names. Spaces do not work.

  2. Enter the following command to refresh the computer’s configuration:

     # refresh –s syslogd

You now must enable the ACS rules.

To Enable ACS Rules

  1. In the Operations console, click Authoring.

  2. In the navigation pane, click Authoring, click Management Pack Objects, and then click Rules.

  3. In the rules pane, search for the rule to be enabled. If the Look for bar is not available above the Rule list, navigate from the View menu, and then click Find.

  4. Right-click the rule name for the rule that you want to enable, navigate to Overrides , click Override the Rule, and then click For all object of class for a class of objects to be monitored by the rule.

  5. Set the Enabled parameter to True, modify the Override Value to True, and then click OK.