B Policy Monitor Script

This appendix provides a description and examples of the Policy Monitor script.

Section B.1, "Policy Monitor Script and Command Line Examples"

B.1 Policy Monitor Script and Command Line Examples

This section provides a description of the Policy Monitor script, and then provides command line examples.

Section B.1.1, "Description of the Policy Monitor Script"
Section B.1.2, "Examples of Policy Monitor Commands"

B.1.1 Description of the Policy Monitor Script

usage: arr -propertyfile <propertyfile> -command <command> <...args>

Use the above script to start and test an instance of Policy Monitor (use CTRLîC to stop the server).

B.1.1.1 Commands

Note:

Ensure the following property is available and encrypted in the input property file:

arr.jdbc_password

create-tables

Creates the required Policy Monitor database tables and sequences.
- Options
  - -arr.persistence_unit_name
    
    The name of the javax persistence unit defined in persistence.xml.
  - -arr.jdbc_driver
    
    The JDBC database driver type, for example:
    
    - Oracle: oracle.jdbc.OracleDriver
  - -arr.jdbc_url
    
    The JDBC database URL.
  - -arr.jdbc_username
    
    The JDBC database user name.
checks-tables

Checks the required audit server database tables and sequences.
- Options
  - -arr.persistence_unit_name
    
    The name of the javax persistence unit defined in persistence.xml.
  - -arr.jdbc_driver
    
    The JDBC database driver type. For example:
    
    - Oracle: oracle.jdbc.OracleDriver
  - -arr.jdbc_url
    
    The JDBC database URL.
  - -arr.jdbc_username
    
    The JDBC database user name.
drop-and-create-tables

Drops and recreates the Policy Monitor database tables and sequences.
- Options
  - -arr.persistence_unit_name
    
    The name of the javax persistence unit defined in persistence.xml.
  - -arr.jdbc_driver
    
    The JDBC database driver type. For example:
    
    - Oracle: oracle.jdbc.OracleDriver
  - -arr.jdbc_url
    
    The JDBC database URL.
  - -arr.jdbc_username
    
    The JDBC database user name.
parse-audit-msg

Tests the validity of an audit message.
- Options
  - -arr.input_file
    
    A file containing an audit message.
parse-syslog-msg

Tests the validity of a syslog message.
- Options
  - -arr.input_file
    
    A file containing a syslog message.
send-tls-msg

Sends a syslog message to a Policy Monitor supporting TLS.
Note:
Ensure the following properties are available and encrypted in the input property file:
- arr.keystore_password
- arr.truststore_password
- arr.keymanager_keystore_password
- Options
  - -arr.input_file
    
    A file containing a syslog message.
  - -arr.hostname
    
    The host name of the syslog server.
  - -arr.port
    
    The port of the syslog server.
  - -arr.keystore
    
    The client keystore.
  - -arr.truststore
    
    The client truststore.
send-udp-msg

Sends a syslog message to Policy Monitor supporting UDP.
- Options
  - -arr.input_file
    
    A file containing a syslog message.
  - -arr.hostname
    
    The host name of the syslog server.
  - -arr.port
    
    The port of the syslog server.
start-tls-server

Starts a TLS Policy Monitor running on a given port.
Note:
Ensure the following properties are available and encrypted in the input property file:
- arr.keystore_password
- arr.truststore_password
- arr.keymanager_keystore_password
- Options
  - -arr.port
    
    The port to listen on (6514 is the standard port for syslog over TLS).
  - -arr.persistence_unit_name
    
    The name of the javax persistence unit defined in persistence.xml.
  - -arr.jdbc_driver
    
    The JDBC database driver type. For example:
    
    - Oracle: oracle.jdbc.OracleDriver
  - -arr.jdbc_url
    
    The JDBC database URL.
  - -arr.jdbc_username
    
    The JDBC database user name.
  - -arr.keystore
    
    The server keystore.
  - -arr.truststore
    
    The server truststore.
start-udp-server

Starts an UDP Policy Monitor running on a given port.
- Options
  - -arr.port
    
    The port to listen on (514 is the standard port for syslog over UDP).
  - -arr.persistence_unit_name
    
    The name of the javax persistence unit defined in persistence.xml.
  - -arr.jdbc_driver
    
    The JDBC database driver type. For example:
    
    - Oracle: oracle.jdbc.OracleDriver
  - -arr.jdbc_url
    
    The JDBC database URL.
  - -arr.jdbc_username
    
    The JDBC database user name.
start-tcp-server

Starts a TCP Policy Monitor running on a given port.

Note:
This command is not recommended for production use.
- Options
  - -arr.port
    
    The port to listen on.
  - -arr.persistence_unit_name
    
    The name of the javax persistence unit defined in persistence.xml.
  - -arr.jdbc_driver
    
    The JDBC database driver type. For example:
    
    - Oracle: oracle.jdbc.OracleDriver
  - -arr.jdbc_url
    
    The JDBC database URL.
  - -arr.jdbc_username
    
    The JDBC database user name.
send-tcp-msg

Sends a syslog message to a Policy Monitor supporting TCP.
- Options
  - -arr.input_file
    
    A file containing a syslog message.
  - -arr.hostname
    
    The host name of the syslog server.
  - -arr.port
    
    The port of the syslog server.

B.1.2 Examples of Policy Monitor Commands

create-tables

> arr -propertyfile arr.properties -command create-tables
check-tables

> arr -propertyfile arr.properties -command check-tables
drop-and-create-tables

> arr -propertyfile arr.properties -command drop-and-create-tables
parse-audit-msg

> arr -propertyfile arr.properties -command parse-audit-msg -arr.input_file test_audit_msg.txt
parse-syslog-msg

> arr -propertyfile arr.properties -command parse-syslog-msg -arr.input_file test_syslog_msg.txt
send-tcp-msg

> arr -propertyfile arr.properties -command send-tcp-msg -arr.hostname localhost -arr.input_file test_syslog_msg.txt
send-tls-msg

> arr -propertyfile arr.properties -command send-tls-msg -arr.hostname localhost -arr.input_file test_syslog_msg.txt
send-udp-msg

> arr -propertyfile arr.properties -command send-udp-msg -arr.hostname localhost -arr.input_file test_syslog_msg.txt
start-tcp-server

> arr -propertyfile arr.properties -command start-tcp-server
start-tls-server

> arr -propertyfile arr.properties -command start-tls-server
start-udp-server

> arr -propertyfile arr.properties -command start-udp-server