Specifying a User-defined Emitter (deprecated)

Note: Audit Manager is deprecated and provided for backward compatibility only. We recommend that you use syslog events instead. See Enterprise Server Auditing for more information.

Restriction: This topic applies only when the Enterprise Server feature is enabled.

Syntax:

In the Audit Manager Configuration file, you use the following line to define an audit emitter that you have created. That is, it assigns an emitter name to your emitter program. Once you use this command, you can then use this emitter with the mfaudit.dest configuration.

mfaudit.emitter.emitter-name=program-name

Parameters:

`emitter-name`	The name of the emitter being defined. This name can be specified in mfaudit.dest entries elsewhere in the configuration file. Emitter names are case-insensitive.
`program-name`	The name of the program that implements the emitter interface and that will be invoked by the audit facility when outputting events to the destination named by `emitter-name`.

Default:

Not applicable.

Comments:

mfaudit.emitter is used to define a user-specific emitter. Where there are multiple mfaudit.emitter for the same emiter, the last-most is used.

Note: We recommend that custom emitters that you use should be written in C. They should not be written in COBOL due to potential recursion issues during CTF tracing.

Examples:

1) Define a user-specific emitter named MYAUDIT and make it a default audit emitter.

...
mfaudit.emitter.MYAUDIT=myauditemitter.dll
mfaudit.dest=MYAUDIT
...

2) Replace the well-known AUDITFILE emitter.

...
mfaudit.emitter.AUDITFILE=myauditfileemitter.so
...