Agent Host AVCLI Commands

The agent host AVCLI commands enable you to perform agent host-related tasks such as registering hosts.

About the Agent Host AVCLI Commands

The AVCLI host commands enable you to configure the host computer on which the Audit Vault Agent will reside.

ACTIVATE HOST

Learn how to use the ACTIVATE HOST AVCLI command.

The ACTIVATE HOST command activates the host specified by hostname.

Syntax

ACTIVATE HOST <hostname>

Arguments

Argument	Description
hostname	The host name.

Usage Notes

Once an host is activated, an activation key appears, which must be entered when an Agent process is started to complete activation process.

Example

avcli> ACTIVATE HOST sample_host.example.com;

Activates the host, sample_host.example.com, and displays the activation key for this host.

ALTER HOST

Learn how to use the ALTER HOST AVCLI command.

The ALTER HOST command alters a host registered with the Audit Vault Server.

Syntax

ALTER HOST <hostname> SET {<key>=<value> [,<key>=<value>...]}

ALTER HOST <hostname> SET {<key>=<value> [,<LOGLEVEL>=<component_name:loglevel_value>...]}

ALTER HOST <hostname> DROP ATTRIBUTE {<attribute name>}

Arguments

Argument	Description
hostname	The name of the host.
key	The attribute being changed. See Table A-1 for supported key values.

Usage Notes

This command alters the attributes associated with the named host using key/value pairs. To modify multiple attributes in a single command invocation, specify comma separated key/value pairs.

The following host name attributes are supported:

Table 1 Host Attributes (key values)

Parameter	Description
`NAME`	The new host name that replaces the existing one.
`IP`	The new IP address that replaces the existing IP address.
`LOGLEVEL`	The log level of various code components running on this host. This option can dynamically change the log levels of various Audit Vault Server code components. The `LOGLEVEL` attribute takes a two part value, separated by a colon, as follows: `component_name`:`loglevel_value` where `component_name` can be `av.agent`, `av.common`, `av.server`: See Table A-2 for descriptions of `LOGLEVEL` component names, and Table A-3 for `LOGLEVEL` values. Multiple components log levels can be changed by delimiting them using the \| symbol.
`AGENT_PHYSICAL_ADDRESS_XX`	XX can be any value between 01 and 99. The value for the attribute must be a valid IP address of a node in a UNIX cluster environment or the IP address of a secondary network interface card (NIC) if the host machine where the agent is installed has multiple network cards.
`AUTO_RESTART`	The value can be either Y on N. Use Y to configure the Agent auto restart service remotely, for an Agent running on a Linux/Unix/AIX/Solaris platforms. Use N to unregister.

Note: Ensure to understand the Agent’s functionality completely before modifying the above mentioned values. They have been set to optimal value by default. Any incorrect value may degrade the performance.

The following are valid values for the LOGLEVEL attribute:

Table 2 LOGLEVEL Component Names

Parameter	Description
`av.agent`	agent component_name of `LOGLEVEL` value
`av.server`	Audit Vault Server component_name of `LOGLEVEL` value
`av.common`	shared Server and Agent component_name of `LOGLEVEL` value

Table 3 LOGLEVEL Values

Loglevel Value	Description
`INFO`	`INFO` level, `loglevel_value` of `LOGLEVEL` value
`WARNING`	`WARNING` level, `loglevel_value` of `LOGLEVEL` value
`ERROR`	`ERROR` level, `loglevel_value` of `LOGLEVEL` value
`DEBUG`	`DEBUG` level, `loglevel_value` of `LOGLEVEL` value

Examples

avcli> ALTER HOST sample_host.example.com SET ip=192.0.2.1;

Alters the host, sample_host.example.com, and changes the associated IP address to 192.0.2.1.

avcli> ALTER HOST sample_host.example.com SET name=new_sample_host.example.com;

Alters the host, sample_host.example.com, to new_sample_host.example.com. Additionally, it updates the IP address by doing a lookup against new_sample_host.example.com.

avcli> ALTER HOST sample_host.example.com SET loglevel=av.agent:info|av.common:debug;

Alters the log levels of the av.agent and av.common code components embedded in the Agent process running on the host, sample_host.example.com.

DEACTIVATE HOST

Use the DEACTIVATE HOST command to deactivate hosts that are specified by the hostname parameter.

The DEACTIVATE HOST command deactivates the host specified by hostname.

Syntax:

DEACTIVATE HOST <hostname>

Arguments

Argument	Description
hostname	The host name.

Usage Notes

Once a host is deactivated, it may not be able to connect to the Audit Vault Server.

Example

avcli> DEACTIVATE HOST sample_host.example.com;

Deactivates the host, sample_host.example.com. The agent process on this host may not be able to connect to the Audit Vault Server.

DROP HOST

Use the DROP HOST command to drop hosts that are specified by the value of the host_name parameter.

The DROP HOST command drops the host specified by the host_name from the Audit Vault Server and removes any associated metadata.

After dropping a host, if you want to register it again to collect audit data, you must reinstall the Audit Vault Agent on this host.

Syntax

DROP HOST hostname [FORCE]

Arguments

Argument	Description
`hostname`	The name of the host computer being dropped. See Also: [LIST HOST](agent-host-avcli-commands1.html#GUID-E7505E23-CC45-4CFE-80CE-A46FBFE3FD64) to find the names of currently registered hosts. [LIST ATTRIBUTE FOR TARGET](target-avcli-commands1.html#GUID-34B3A30F-6EA5-452E-B314-05A2267C4285)
`FORCE`	This is an optional parameter. Use this argument to forcefully drop the host and all the associated trails, when the hosts or trails are in stopped state or in unreachable state for more than two hours.

Usage Notes

Ensure that the agent process on this host is in the stopped state before dropping the host. The DROP HOST command will fail otherwise.

Example

avcli> DROP HOST sample_host;

The host, sample_host, and any associated metadata is dropped.

LIST HOST

Use the LIST HOST command to see the names of registered Agent host computers.

The LIST HOST command lists the names of the currently registered agent host computers.

Syntax

LIST HOST [hostname]

This command lists the various active hosts registered with the Audit Vault Server.

Argument

Argument	Description
host name	The hostname parameter is optional and can be specified to list a particular active host.

Example

avcli> list host testhost1;

Lists the details of testhost1 registered with the Audit Vault Server.

avcli> LIST HOST;

The various active hosts registered with the Audit Vault Server are listed.

REGISTER HOST

Learn about the REGISTER HOST AVCLI command.

The REGISTER HOST command adds the host to Audit Vault Server and identifies it as a host machine on which an Agent can be deployed.

Syntax

REGISTER HOST <host_name> WITH IP <ip_address>

Arguments

Argument	Description
host_name	The name of the host computer that you want to register. See Also: LIST HOST to find the names of currently registered hosts. LIST ATTRIBUTE FOR TARGET
ip_address	The IP address associated with the host. If the IP address is not specified, then the IP address for the host is deduced by doing a host name lookup on the host name specified. It is possible to override this behavior to associate with a different IP address, by specifying the IP address.

Argument

Description

host_name

The name of the host computer that you want to register.

UPLOAD AGENT LOG FILE TO SERVER FOR HOST

This command uploads Audit Vault Agent log files as a .zip file to the Audit Vault Server.

Syntax

UPLOAD AGENT LOG FILE TO SERVER FOR HOST <hostname>

Arguments

Argument Description

Argument	Description
`hostname`	Name of the agent for which you need to download the log from the Audit Vault Server. For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use `'agentless collection'` as the host name.

hostname

Name of the agent for which you need to download the log from the Audit Vault Server.

For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use 'agentless collection' as the host name.

Example

Upload agent log file to server for host myhost.mycompany.com

Uploads the agent log files as a .zip file to the Audit Vault Server for the myhost.mycompany.com host.
If the total agent log size is less than 300 MB, then all agent log files are uploaded.
If the total agent log size is greater than 300 MB, then only the latest log file for each agent component is uploaded if the latest log file is less than 50 MB.

DOWNLOAD AGENT LOG FILE FROM SERVER FOR HOST

This command downloads Audit Vault Agent log files as a .zip file from the Audit Vault Server and saves the .zip file in the <AVCLI installation path>/av/log directory.

Note: Oracle highly recommends that you delete the agent logs from the AVCLI log location after you upload the agent logs to the relevant service request.

Syntax

DOWNLOAD AGENT LOG FILE FROM SERVER FOR HOST <hostname>

Arguments

Argument Description

Argument	Description
`hostname`	Name of the agent for which you need to download the log from the Audit Vault Server. For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use `'agentless collection'` as the host name.

hostname

Name of the agent for which you need to download the log from the Audit Vault Server.

For agentless collection of Oracle Database table trails and Microsoft SQL Server directory trails, use 'agentless collection' as the host name.

Example

download agent log file from server for host myhost.mycompany.com

Downloads the agent log files as a .zip file from the Audit Vault Server for the myhost.mycompany.com host and saves the .zip in the <AVCLI installation path>/av/log directory.
If the total agent log size is less than 300 MB, then all agent log files are downloaded.
If the total agent log size is greater than 300 MB, then only the latest log file for each agent component is downloaded if the latest log file is less than 50 MB.