Novell IDENTITY MANAGER 3.6.1 User manual

Novell®

www.novell.com

novdocx (en) 17 September 2009

AUTHORIZED DOCUMENTATION

Identity Manager 3.6.1 Reporting Guide for Novell Sentinel

Identity Manager

3.6.1

January 07, 2010

Reporting Guide for Novell Sentinel

novdocx (en) 17 September 2009

Legal Notices

Novell, Inc., makes no representations or warranties with respect to the contents or use of this documentation, and

specifically disclaims any express or implied warranties of merchantability or fitness for any particular purpose.

Further, Novell, Inc., reserves the right to revise this publication and to make changes to its content, at any time,

without obligation to notify any person or entity of such revisions or changes.

Further, Novell, Inc., makes no representations or warranties with respect to any software, and specifically disclaims

any express or implied warranties of merchantability or fitness for any particular purpose. Further, Novell, Inc.,

reserves the right to make changes to any and all parts of Novell software, at any time, without any obligation to

notify any person or entity of such changes.

Any products or technical information provided under this Agreement may be subject to U.S. export controls and the

trade laws of other countries. You agree to comply with all export control regulations and to obtain any required

licenses or classification to export, re-export or import deliverables. You agree not to export or re-export to entities

on the current U.S. export exclusion lists or to any embargoed or terrorist countries as specified in the U.S. export

laws. You agree to not use deliverables for prohibited nuclear, missile, or chemical biological weaponry end uses.

See the Novell International Trade Services Web page (http://www.novell.com/info/exports/) for more information

on exporting Novell software. Novell assumes no responsibility for your failure to obtain any necessary export

approvals.

stored on a retrieval system, or transmitted without the express written consent of the publisher.

Novell, Inc., has intellectual property rights relating to technology embodied in the product that is described in this

document. In particular, and without limitation, these intellectual property rights may include one or more of the U.S.

patents listed on the Novell Legal Patents Web page (http://www.novell.com/company/legal/patents/) and one or

more additional patents or pending patent applications in the U.S. and in other countries.

Novell, Inc.

404 Wyman Street, Suite 500

Waltham, MA 02451

U.S.A.

www.novell.com

Online Documentation: To access the latest online documentation for this and other Novell products, see

the Novell Documentation Web page (http://www.novell.com/documentation).

novdocx (en) 17 September 2009

Novell Trademarks

For Novell trademarks, see the Novell Trademark and Service Mark list (http://www.novell.com/company/legal/

trademarks/tmlist.html).

Third-Party Materials

All third-party trademarks are the property of their respective owners.

4Identity Manager 3.6.1 Reporting Guide for Novell Sentinel

novdocx (en) 17 September 2009

Contents 5

Contents

novdocx (en) 17 September 2009

About This Guide 7

1Overview 9

1.1 Sentinel Integrated Architecture. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 9

2 Configuring Novell Sentinel with Identity Manager 11

3 Installing and Configuring the Identity Manager Collector 13

3.1 Installing the Identity Manager Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

3.2 Configuring the Identity Manager Collector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 13

4 Installing and Configuring the Novell Audit Connector 17

4.1 Installing the Novell Audit Connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

4.2 Configuring the Novell Audit Connector . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 17

5 Installing and Configuring the Platform Agent 21

5.1 Installing the Platform Agent . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

5.2 Configuring the Platform Agent Text File . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 21

6 Securing the Logging System 25

7 Managing Identity Manager Events 27

7.1 Selecting Events to Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

7.1.1 Selecting Events for the User Application . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 27

7.1.2 Selecting Events for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 29

7.1.3 Selecting Events for a Specific Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 30

7.1.4 Identity Manager Log Levels . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 31

7.2 User-Defined Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

7.2.1 Using Policy Builder to Generate Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 32

7.2.2 Using Status Documents to Generate Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 35

7.3 eDirectory Objects that Store Identity Manager Event Data. . . . . . . . . . . . . . . . . . . . . . . . . . . 35

8 Using Status Logs 37

8.1 Setting the Log Level and Maximum Log Size. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 37

8.1.1 Setting the Log Level and Log Size for the Driver Set . . . . . . . . . . . . . . . . . . . . . . . . 37

8.1.2 Setting the Log Level and Log Size for the Driver . . . . . . . . . . . . . . . . . . . . . . . . . . . 38

8.2 Viewing Status Logs. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

8.2.1 Accessing the Driver Set Status Log . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 39

8.2.2 Accessing the Publisher Channel and Subscriber Channel Status Logs . . . . . . . . . 40

6Identity Manager 3.6.1 Reporting Guide for Novell Sentinel

novdocx (en) 17 September 2009

9 Querying and Reporting 41

A Identity Manager Events 43

A.1 Event Structure . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

A.2 Error and Warning Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 43

A.3 Job Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

A.4 Remote Loader Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 44

A.5 Object Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

A.6 Password Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 45

A.7 Search List Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

A.8 Engine Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 46

A.9 Server Events. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 49

A.10 Security Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 50

A.11 Workflow Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 51

A.12 Driver Start and Stop Events . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

A.13 Log Schema Files . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 52

A.13.1 How LSC Files Are Used . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . 53

About This Guide 7

novdocx (en) 17 September 2009

About This Guide

Welcome to the Identity Manager Integration Guide for Novell Sentinel. This guide provides the

information necessary to integrate Novell®SentinelTM with Identity Manager to provide auditing and

reporting services.

Chapter 1, “Overview,” on page 9

Chapter 2, “Configuring Novell Sentinel with Identity Manager,” on page 11

Chapter 3, “Installing and Configuring the Identity Manager Collector,” on page 13

Chapter 4, “Installing and Configuring the Novell Audit Connector,” on page 17

Chapter 5, “Installing and Configuring the Platform Agent,” on page 21

Chapter 6, “Securing the Logging System,” on page 25

Chapter 7, “Managing Identity Manager Events,” on page 27

Chapter 8, “Using Status Logs,” on page 37

Chapter 9, “Querying and Reporting,” on page 41

Appendix A, “Identity Manager Events,” on page 43

Audience

This guide is intended for network administrators.

Feedback

We want to hear your comments and suggestions about this manual and the other documentation

included with this product. Please use the User Comments feature at the bottom of each page of the

online documentation, or go to www.novell.com/documentation/feedback.html and enter your

comments there.

Documentation Updates

For the most recent version of the Identity Manager 3.6.1 Integration Guide for Novell Sentinel,

visit the Identity Manager Documentation Web site (http://www.novell.com/documentation/idm36/

Additional Documentation

For the current Sentinel documentation, see the Sentinel Documentation Web site (http://

www.novell.com/documentation/sentinel61/index.html).

Documentation Conventions

In Novell documentation, a greater-than symbol (>) is used to separate actions within a step and

items in a cross-reference path.

A trademark symbol (®, TM, etc.) denotes a Novell trademark. An asterisk (*) denotes a third-party

trademark.

8Identity Manager 3.6.1 Reporting Guide for Novell Sentinel

novdocx (en) 17 September 2009

When a single pathname can be written with a backslash for some platforms or a forward slash for

other platforms, the pathname is presented with a backslash. Users of platforms that require a

forward slash, such as Linux* or UNIX*, should use forward slashes as required by your software.

Overview

novdocx (en) 17 September 2009

Overview

Adding Novell SentinelTM to your Identity Manager solution provides a reporting services. By

adding reporting, you can demonstrate that the business policies are enforced within your Identity

Manager solution. This is the last component to add to your Identity Manager solution.

1.1 Sentinel Integrated Architecture

Sentinel is a security information management and compliance monitoring solution that monitors,

responds to, and reports on security and compliance events. Sentinel easily integrates with Novell

Identity Manager so you get automated, real-time security management and compliance monitoring

across all systems and networks. The Sentinel-Identity Manager framework provides automatic

documenting and reporting of security, systems, and access events across the enterprise; built-in

incident management and remediation; and the ability to demonstrate and monitor compliance with

internal policies and government regulations.

The following diagram illustrates the Identity Manager logging and reporting architecture when

integrated with Sentinel.

Figure 1-1 Identity Manager and Sentinel Integrated Architecture

1. An Identity Manager event occurs and it is sent to the Platform Agent. To capture all Identity

Manager events, the Platform Agent must be installed and configured on each Identity Manager

server.

Collector

Sentinel

Control Center

Identity

Manager

Platform

Agent

Events

Cache

When disconnected

from the Event

Source Server

When reconnected

to the Event

Source Server

Crystal

Reports

Data Store

Port 289

Audit

Queue

Event Source Server

Port 9099

Novell

Audit

Connector

Identity

Manager

Collector

Manager

10 Identity Manager 3.6.1 Reporting Guide for Novell Sentinel

novdocx (en) 17 September 2009

2. (Conditional) If the Platform Agent cannot connect to the Event Source Server, the events are

stored in cache until the connection is reestablished.

3. The Platform Agent sends the events to the Event Source Sever, which stores the events in the

audit queue.

4. The events in the audit queue are sent to the Novell Audit Connector.

5. The Novell Audit Connector sends the events to the Identity Manager Collector, which parses

the information and then stores the parsed events in the data store.

6. The stored events are displayed through Crystal Reports*.

For a thorough discussion of the Sentinel architecture, see “Appendix A Sentinel Architecture” in

the Novell Sentinel User’s Guide (http://www.novell.com/documentation/sentinel61/pdfdoc/

sentinel_61_user_guide.pdf).

Other manuals for IDENTITY MANAGER 3.6.1

Table of contents

Other Novell Software manuals

Novell

Novell OPEN ENTERPRISE SERVER 2 SP2 -... User manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 - DEPLOYMENT GUIDE... Quick reference guide

Novell

Novell ZENWORKS 10 ASSET MANAGEMENT SP3 - MIGRATION GUIDE 10.3... User manual

Novell

Novell APPARMOR - AND User manual

Novell

Novell ZENWORKS HANDELD MANAGEMENT 7 SP1 IR4 Instruction Manual

Novell

Novell ZENWORKS LINUX MANAGEMENT 7.3 IR2 - ADMINISTRATION GUIDE... Instruction Manual

Novell

Novell APPARMOR 2.0.1 Instruction Manual

Novell

Novell ZENWORKS NETWORK ACCESS CONTROL 5.0 - ... User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - ENTITLEMENTS User manual

Novell

Novell GROUPWISE 7 - DATABASES User manual

Novell

Novell GROUPWISE 7 GATEWAY FOR MICROSOFT EXCHANGE - INSTALLATION AND... Instruction Manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 User manual

Novell

Novell XDASV2 - ADMINISTRATION GUIDE V1 Instruction Manual

Novell

Novell GROUPWISE 7 - LIBRARIES AND DOCUMENTS User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - PASSWORD MANAGEMENT User manual

Novell

Novell OPEN ENTERPRISE SERVER 2.0 SP2 - DOMAIN SERVICE FOR... User manual

Novell

Novell SENTINEL 6.1 SP2 - INSTALLATION GUIDE... User manual

Novell

Novell GROUPWISE 7 - SECURITY POLICIES User manual

Novell

Novell LINUX ENTERPRISE SERVER 10 - ARCHITECTURE-SPECIFIC INFORMATION... Manual

Novell

Novell GROUPWISE 7 - TROUBLESHOOTING 2 User manual

Novell

Novell IFOLDER 3.6 - SECURITY ADMINISTRATION User manual

Novell

Novell IDENTITY MANAGER 3.6.1 - E-MAIL User manual

Novell

Novell SENTINEL 6.1 SP2 - INSTALLATION GUIDE... User manual

Novell

Novell LINUX ENTERPRISE DESKTOP 10 SP2 Manual

Popular Software manuals by other brands

COMPRO

COMPRO COMPROFM manual

Muratec

Muratec OFFICEBRIDGE ONLINE user guide

Oracle

Oracle Contact Center Anywhere 8.1 installation guide

Adobe

Adobe 65007312 - Photoshop Lightroom Programmer's guide

Avaya

Avaya NULL One-X for RIM Blackberry user guide

HP ProLiant BL420c user guide

PS Audio

PS Audio PowerPlay Programming manual

Brady

Brady LOCKOUT PRO 3.0 Administrator's guide

Avaya

Avaya Interaction Center user guide

Texas Instruments

Texas Instruments TI-83 Plus Silver Edition Guide book

Oracle

Oracle Application 9i Configuration guide

Acer

Acer RDM user guide

Canon

Canon Vixia HF21 instruction manual

Canon

Canon ZR950 instruction manual

Samsung

Samsung Auto Backup user manual

Polycom

Polycom Vortex EF2201 Application note

Brocade Communications Systems

Brocade Communications Systems Brocade 8/12c user manual

Lexmark

Lexmark Apps Administrator's guide