audittrail.<product>.<component>.targets
This parameter specifies how to calculate where the system sends the audit trail information for a particular component if you have also set the corresponding audittrail.<product>.<component>.overrides parameter.
There are two kinds of audit trail targets that can be overridden:
-
Whether to enable the DirectAudit audit trail target for the component or not
-
Whether to enable the local logging system audit trail target or not. On UNIX systems, the local logging system is syslog and on Windows systems it's the Windows event log.
For this setting, you specify a single numeric value to represent which audit trail targets are enabled for the component. The possible settings are as follows:
| Value | Enable the DirectAudit audit trail target for the component? | Enable the local logging audit trail target for the component? | Description |
|---|---|---|---|
| -1 | No | No | Use the global audit trail target value. This is the default setting. |
| 0 | No | No | Neither the DirectAudit nor the local logging target are enabled for the component. |
| 1 | Yes | No | Enable only the DirectAudit audit trail target for the component. This capability is supported by DirectAudit version 3.2 and later. |
| 2 | No | Yes | Enable only the local logging audit trail target for the component. |
| 3 | Yes | Yes | Enable the audit trail targets for both DirectAudit and the local logging system. |
In most cases, you set this configuration parameter using the Computer Configuration > Policies > Administrative Templates Policy definitions (ADMX files) > Delinea Audit Trail Settings group policy.
The system calculates the final audit trail targets for a component based on the following information:
-
If audittrail.<product>.<component>.overrides is not specified, the system uses the global audit trail target value
-
If audittrail.<product>.<component>.overrides is specified, for each target (DirectAudit and local logging), whether the audit trail information will be sent to this target is determined by the following:
-
If audittrail.<product>.<component>.targets is set to -1, or the setting is not overridden in audittrail.<product>.<component>.overrides, the system uses the global audit trail target value
-
If the target is overridden by audittrail.<product>.<component>.overrides and enabled by audittrail.<product>.<component>.targets, the system sends the audit trail information to this target
-
