Log Files

When you set up an application or a provider to log events, its events are recorded in log files. All log records are stored in the path: /var/sadm/wbem/logr. Log files use the following naming convention:

wbem_log.#

where # is a number appended to indicate the version of the log file. A log file appended with a .1, such as wbem_log.1, is the most recently saved version. A log file appended with a .2 is the next oldest version. Larger file extensions, for example, wbem_log.16, indicate older versions of the file. Previous versions of the log file and the most recent version co-exist as an archive in /usr/sadm/wbem/log.

Log files are saved and renamed with a .1 filename extension when one of the following two conditions are met:

• The current file reaches the file size limit specified by the Solaris_LogServiceProperties class. Default values are set in the /usr/sadm/lib/wbem/WbemServices.properties file.

  For information about how the properties of the Solaris_LogServiceProperties class control how a log file is used, see "Log File Rules".

• The clearLog() method of the Solaris_LogService class is invoked on the current log file.

  For information about the Solaris_LogService class and its methods, see "Solaris_LogService Class".

Log File Rules

The Solaris_LogServiceProperties class is defined in Solaris_Core1.0.mof. The Solaris_LogServiceProperties class has properties that control the following attributes of a log file:

• Directory where the log file is written

• Name of the log file

• Size allowed for a log file before it is saved and renamed with a .1 file extension.

• Number of log files you can have in the archive

• Ability to write log data to syslog, the default logging system of the Solaris operating environment

To specify any of these attributes for an application that writes data to a log file, create a new instance of Solaris_LogServiceProperties and set the values of its associated properties. See Example 5-2 for detailed information about how to set the property values of the new instance.

Log File Format

The logging service provides three categories of log records: application, system, and security. Log records may be informational, or may record data derived from errors or warnings. A standard set of fields are defined for the data that can be presented in logs. Logs do not necessarily use all the fields, however. For example, an informational log may provide a brief message describing an event. An error log may provide a more detailed message.

Some log data fields are required to identify data in the CIM Repository. These fields are properties flagged with a read-only key qualifier in the Solaris_LogRecord class. You cannot set the values of these fields. You can, however, set the values of any of the following fields in your log files:

• Category - Type of log record

• Severity - Severity of conditions that caused data to be written to a log file

• AppName - Name of the application from which the data was obtained

• UserName - Name of the individual who was using the application when log data was generated

• ClientMachineName - Name of the computer on which an incident occurred that generated log data

• ServerMachineName - Name of the server on which an incident occurred that generated log data

• SummaryMessage - Brief message describing the occurrence

• DetailedMessage - Detailed message describing the occurrence

• Data - Context information that applications and providers can present to interpret a log message