Veritas Access Appliance Initial Configuration and Administration Guide

To do a basic SDCS log search

1. Log on to the Access Appliance shell menu.
2. From the Main_Menu > Monitor > SDCS view, enter the following command:

   Audit Search <term>

   Where <term> is a word or name that you want to search in the logs for.

To filter SDCS log entries by date

1. Log on to the Access Appliance shell menu.
2. Go to the Main_Menu > Monitor > SDCS view.
3. (Optional) Enter the following command to view all of the events that occurred on a specific day:

   Audit View Date <ToDate>

   Where <ToDate> is the day in the DD/MM/YYYY format.

4. (Optional) Enter the following command to view all of the events that occurred during a specific period of time:

   Audit View Date <ToDate>[-hh:mm:ss] [<FromDate>[-hh:mm:ss]]

   Where <ToDate>[-hh:mm:ss] is the later date/time and [<FromDate>[-hh:mm:ss]] is the earlier date/time. For example:

   Audit View Date 05/25/2016-13:00:00 05/25/2016-12:00:00

To filter SDCS log events by severity

1. Log on to the Access Appliance shell menu.
2. From the Main_Menu > Monitor > SDCS view, enter the following command:

   Audit View Severity <SeverityCode>

   Where <SeverityCode> is the one letter code of the severity type that you want to filter by.

   See About SDCS event type codes and severity codes on an Access appliance node.

To filter SDCS log entries by type

1. Log on to the Access Appliance shell menu.
2. From the Main_Menu > Monitor > SDCS view, enter the following command:

   Audit View EventType <TypeCode>

   Where <TypeCode> is the four letter code of the event type that you want to filter by.

   See About SDCS event type codes and severity codes on an Access appliance node.

To filter SDCS log entries by date

1. Log on to the Access Appliance shell menu.
2. From the Main_Menu > Monitor > SDCS view, enter the following command:

   Audit View Filter <SeverityCode> <TypeCode> <ToDate>[-hh:mm:ss] [<FromDate>[-hh:mm:ss]] <Search_yes/no>

   • <SeverityCode>

     The one letter code of the severity type that you want to filter by. Enter ALL if you want to include all severity codes in your filter.

   • <TypeCode>

     The four letter code of the event type that you want to filter by. Enter ALL if you want to include all event type codes in your filter.

   • <ToDate>[-hh:mm:ss] [<FromDate>[-hh:mm:ss]]

     Where <ToDate>[-hh:mm:ss] is the later date/time and [<FromDate>[-hh:mm:ss]] is the earlier date/time. Use the DD/MM/YYYY date format.

     To filter events for a specific day, use <ToDate>[-hh:mm:ss] and type NULL for [<FromDate>[-hh:mm:ss]].

     To filter all events after a specific date/time, use [<FromDate>[-hh:mm:ss]] and type NULL for <ToDate>[-hh:mm:ss]

   • <Search_yes/no>

     Enter yes if you want to include a search term. Otherwise, enter no.

   For example:

   Audit View Filter C ALL 05/26/2016-14:00:00 05/25/2016-13:00:00 no

3. (Optional) If you entered yes for <Search_yes/no>, enter the search string when prompted.

To get more details about a specific SDCS event

1. Log on to the Access Appliance shell menu.
2. From the Main_Menu > Monitor > SDCS view, enter the following command:

   Audit View EventID <ID#>

   Where <ID#> is the ID number of an event that was listed in your filter or search.