Sets the format and handling characteristics of event files.
Mode
Exec > Global Configuration > Context Configuration > Session
Event Module Configuration
configure > context
context_name
> session-event-module
Entering the above command sequence results in the following prompt:
[context_name]host_name(config-event)#
Syntax
file [ compression { gzip | none } ] [ current-prefix string ] [ delete-timeout seconds ] [ directory directory_name ] [ exclude-checksum-record ] [ field-separator { hyphen | omit | underscore } ] [ file-sequence-number rulebase-seq-num ] [ headers ] [ name file_name ] [ reset-indicator ] [ rotation [ num-records number | time seconds | volume bytes ] ] [ sequence-number { length length | omit | padded | padded-six-length | unpadded } ] [ storage-limit limit ] [ time-stamp { expanded-format | rotated-format | unix-format } ] [ trailing-text string ] [ trap-on-file-delete ] [ xor-final-record ] +
default file [ compression ] [ current-prefix ] [ delete-timeout ] [ directory ] [ field-separator ] [ file-sequence-number ] [ headers ] [ name ] [ reset-indicator ] [ rotation { num-records | time | volume } ] [ sequence-number ] [ storage-limit ] [ time-stamp ] [ trailing-text ] +
default
Configures the default setting for the specified keyword(s).
compression { gzip | none }
Specifies compression of
P-GW or
S-GW event files.
current-prefix
string
Specifies a string to add to the beginning of the event file that is
currently being used to store records.
string must be an alphanumeric string of 1
through 31 characters. Default:
curr
delete-timeout
seconds
Specifies a time period, in seconds, after which event files are
deleted. By default, files are never deleted.
seconds must be an integer from 3600 through
31536000. Default: Disabled
directory
directory_name
Specifies a subdirectory in the default directory in which to store
event files.
directory_name must be an alphanumeric
string of 1 through 191 characters. Default:
/records/event
exclude-checksum-record
Excludes the final record containing #CHECKSUM followed by the 32-bit
Cyclic Redundancy Check (CRC) of all preceding records from the event file.
Default: Disabled, a checksum record is included in the event file
header.
field-separator [ hyphen | omit | underscore
]
Specifies the type of separators between two fields of an event file
name:
-
hyphen : Specifies the field separator as
a "-" (hyphen) symbol between two fields.
-
omit : Removes or omits the field
separator between two fields.
-
underscore : Specifies the field
separator as an "_" (underscore) symbol between two fields.
file-sequence-number
rulebase-seq-num
Specifies that the file name sequence numbers be unique per rulebase
and event format name combination.
headers
Includes a file header summarizing the record layout.
name
file_name
Specifies a string to be used as the base file name for event files.
file_name must be an alphanumeric string of
1 through 31 characters. The file name format is as follows:
base_sequencenum_timestamp Default:
event
-
base : Specifies type of record in file
or contains the operator-specified string. Default:
event
-
sequencenum : This is a 5-digit sequence
number to detect the missing file sequence. It is unique among all event files
on the system.
-
timestamp : Adds a file creation
timestamp (UTC time) in MMDDYYYYHHMMSS format.
reset-indicator
Specifies the inclusion of the reset indicator counter (value from 0
through 255) in the event file name. The counter is incremented whenever any of
the following conditions occur:
rotation { num-records
number
| time
seconds
| volume
bytes
}
Specifies when to close an event file and create a new one.
-
num-records
number : Specifies the
maximum number of records that should be added to an event file. When the
number of records in the file reaches this value, the file is complete.
number must be an integer 100 through
10240. Default: 1024
-
time
seconds : Specifies the
period of time to wait (in seconds) before closing the current event file and
creating a new one.
seconds must be an integer from 30
through 86400. Default: 3600
-
volume
bytes : Specifies the
maximum size of the event file (in bytes) before closing it and creating a new
one.
bytes must be an integer from 51200
through 62914560. Note that a higher setting may improve the compression ratio
when the compression keyword is set to gzip. Default: 102400
sequence-number { length
length
| omit | padded | padded-six-length |
unpadded }
Includes with a specified format or excludes the sequence number in
the file name.
-
length
length : Includes the
sequence number with the specified length.
length must be the file sequence number
length with preceding zeroes in the file name, and must be an integer from 1
through 9.
-
omit : Excludes the sequence number from
the file name.
-
padded : Includes the padded sequence
number with preceding zeros in the file name. This is the default setting.
-
padded-six-length : Includes the padded
sequence number with six preceding zeros in the file name.
-
unpadded : Includes the unpadded sequence
number in the file name.
Default:
padded
storage-limit
limit
Files will be deleted when the specified amount of space (in bytes) is reached.
limit must be an integer from 10485760
through 536870912. Default: 33554432
time-stamp { expanded-format | rotated-format |
unix-format }
Specifies the format of the file creation timestamp to be included in
the file name.
-
expanded-format : Specifies the UTC
(Universal Time Coordinated) MMDDYYYYHHMMSS format.
-
rotated-format : Specifies the time stamp
format to YYYYMMDDHHMMSS format.
-
unix-format : Specifies the UNIX format
of
x .y , where
x is the number of seconds since 1/1/1970
and
y is the fractional portion of the
current second that has elapsed.
trailing-text
string
Specifies the inclusion of an arbitrary text string in the file name
as an alphanumeric string of 1 through 30 characters.
trap-on-file-delete
Instructs the system to send an SNMP notification (trap) when an event
file is deleted due to lack of space.
Default: Disabled
xor-final-record
Specifies inserting an exclusive OR (XOR) checksum (instead of a CRC
checksum) into the event file header if the
exclude-checksum-record is left at its
default setting. Default: Disabled
+
More than one of the previous keywords can be entered within a single
command.
Usage Guidelines
Use this command to configure event file characteristics.
Examples
The following command sets the prefix of the current active event file
to
Current :
file current-prefix Current
The following command sets the base file name to
Eventfile :
file name Eventfile