Novell eDirectory Sample Event Message
Use this sample event message to verify a successful integration with JSA.
Note:
Due to formatting issues, paste the message format into a text editor and then remove any carriage return or line feed characters.
Novell eDirectory sample message when you use the Syslog protocol
The following sample event message shows that an account security token modification failed.
eDirectory: INFO {"Source" : "eDirectory#DS","Observer" : {"Account" : {"Domain" : "DOMAINEXAMPLE-
TEST","Name" : "CN=ws,OU=SRV,O=COMPANY"},"Entity" : {"SysAddr" :
"172.16.20.1","SysName" : "ws.domain.example.test"}},"Initiator" : {"Account" : {"Domain" :
"DOMAIN-EXAMPLE-TEST","Name" : "CN=ws,OU=SRV,O=COMPANY"},"Entity" : {"SysAddr" :
"172.16.20.1"}},"Target" : {"Data" : {"ClassName" : "User","Version" : "2"},"Account" :
{"Domain" : "DOMAIN-EXAMPLE-TEST","Name" : "CN=TEST,OU=usr,O=ORG","Id" : "11111111"}},"Action" :
{"Event" : {"Id" : 0.0.0.6","Name" : "MODIFY_ACCOUNT_SECURITY_TOKEN","CorrelationID" :
"eDirectory#0#","SubEvent" : "DSE_CHGPASS"},"Time" : {"Offset" : 1567083869},"Log" :
{"Severity" : 7},"Outcome" : "1.10","ExtendedOutcome" : "-215"}}|
JSA field name |
Highlighted values in the event payload |
|---|---|
|
Event ID |
MODIFY_ACCOUNT_SECURITY_TOKEN - FAILED is extracted from the Event.Name and Outcome fields in Action object. If Outcome = 0, then eventID = Event.Name. Otherwise, eventID = Event.Name + "-FAILED", as shown in this sample event. |
|
Device Category |
eDirectory |
|
Username |
TEST |
|
Source IP |
172.16.20.1 |
|
Device Time |
1567083869 (which is Aug 29, 2019, 10:04:29 AM) Chapter |