Web server account manager plug-in for monitoring resources6026440Abstract An account manager plug-in for a Web server having an application programming interface (API). The plug-in is preferably a computer program product comprising a set of instructions (program code) encoded on a computer-readable substrate. This plug-in includes program code for establishing a set of one or more monitored resources (e.g., UrlCounter, ByteCounter, PageCounter and FailedLoginCounter) and for defining a threshold rule for at least one of the set of monitored resources. As Web transactions occur at the Web server, the account manager is responsive to a monitored resource exceeding a condition of a threshold rule for triggering one of a set of threshold actions. The set of threshold actions, for example, include clearing a record counter, running a given program, sending an e-mail note and disabling or enabling a user account. Claims Having thus described our invention, what we claim as new and desire to secure by Letters Patent is set forth in the following claims: Description TECHNICAL FIELD
______________________________________
.cndot.[threshold-rule-title]
trigger = {urlcounter .vertline. bytecounter .vertline. pagecounter
.vertline. failedlogincounter }
triggercomparison = {> .vertline. < .vertline. = .vertline. >= .vertline.
<= .vertline. <>}
triggervalue = triggervalue-value
urlpath = {urlpath-value1 [... urlpath-valueN]}
dceusername = {dceusername-value1 .cndot.... dceusername-valueN]}
action = {none .vertline. clear .vertline. program .vertline. note }
actionparameter = actionparameter-value
logfile = logfile-value
______________________________________
The title of the threshold rule is stored between brackets and indicates the beginning of a new threshold rule definition. The threshold keywords and values are defined as follows: trigger-keyword This keyword allows administrators to define a threshold rule against a resource monitored by the account manager. The available trigger values match each of the monitored resource counters on a one-to-one basis. The administrator must define the monitoring of the resource corresponding to the trigger-value in the server configuration file for a threshold rule with the monitored resource to be triggered. If the resource is not monitored and a threshold rule contains the trigger keyword and a value corresponding to the unmonitored resource, the threshold rule will be skipped. For example, if the trigger-value is PageCounter for a threshold rule and the set of PageCounter keywords are not defined in the configuration file, the threshold rule will be skipped. This keyword and its accompanying value are required for a threshold rule to be valid. Invalid threshold rules are ignored. trigger-value Valid trigger-values are: {urlcounter.vertline.bytecounter.vertline.pagecounter.vertline.failedlogin counter}. If a trigger-value is not specified or does not match one of the valid values, the threshold rule is invalid. Invalid threshold rules are ignored. triggercomparison-keyword This keyword allows administrators to compare a monitored resource counter value against an integer value defined as the triggervalue-value. The triggercomparison-value matches each of the arithmetic comparison operators. This keyword and its accompanying value are required for a threshold rule to be valid. Invalid threshold rules are ignored. triggercomparison-value Valid triggercomparison-values are: {>.vertline.<.vertline.=.vertline.>=.vertline.<=.vertline.<>} If a triggercomparison-value is not specified or does not match one of the valid values, the threshold rule is invalid. Invalid threshold rules are ignored. triggervalue-keyword This keyword allows administrators to specify an integer number for a monitored resource counter to be compared against. The triggervalue-keyword value is specified as an integer number. This keyword and its accompanying value are required for a threshold rule to be valid. Invalid threshold rules are ignored. triggervalue-value A triggervalue-value is an integer between 0 and the maximum integer value defined for the target platform. If a triggervalue-value is not specified or if it is not an integer, the value defaults to 0. If the specified value is greater than the maximum allowed value for the target platform, the value will be defaulted to the maximum value. urlpath-keyword This keyword allows administrators to compare the url path for a transaction against one or more url paths defined in the urlpath-value. This keyword is optional and can be defined in addition to the trigger keywords. If this keyword is not specified as part of a threshold rule, the rule considers all url paths to match. urlpath-value(s) This value allows administrators to define one or more url paths that a transaction passing the trigger comparison should match against. If more than one url path is specified, the threshold rule will match against any of them. If more than one url path is specified, each urlpath-value must be separated by a blank space. Tab characters in the value will be changed into blank spaces. Duplicate url paths in the value will be ignored. Each urlpath-value can contain a regular expression as defined by the regcomp expression rules. If any urlpath-value contains an invalid regular expression, the entire threshold rule is invalid. Invalid threshold rules are ignored. dceusername-keyword This keyword allows administrators to compare the DCE user name for a transaction against one or more DCE user names defined in the dceusername-value. This keyword is optional and can be defined in addition to the trigger keywords. If this keyword is not specified as part of a threshold rule, the rule considers all DCE user names to match. dceusername-value(s) This value allows administrators to define one or more DCE user names that a transaction passing the trigger comparison should match against. If more than one DCE user name is specified, the threshold rule will match against any of them. If more than one DCE user name is specified, each dceusername-value must be separated by a blank space. Tab characters in the value will be changed into blank spaces. Duplicate DCE user names in the value will be ignored. Each dceusername-value can contain a regular expression as defined by the regcomp expression rules. If any dceusername-value contains an invalid regular expression, the entire threshold rule is invalid. Invalid threshold rules are ignored. action-keyword This keyword allows administrators to execute an action if the trigger comparison is true and if any of the urlpath or dceusername comparisons matched. If this keyword is not specified, the action defaults to none. action-value Valid action-values are {none.vertline.clear.vertline.program.vertline.note}. The following table explains the operation performed for each action.
TABLE 1
______________________________________
Action Values
Action-
Value Operation
______________________________________
none Performs no action. Specified only when the
administrator wants to log a threshold, but not take an
action on it.
clear Resets the counter matching the triggered monitored
resource to zero. This action will not trigger any
additional threshold rules.
program Spawns a program asynchronously. The output or
return code from the program are not saved by the
account manager. The program is run under the same
uid and gid as the web server.
note Sends an e-mail note.
______________________________________
If an action value is not specified or does not match one of the valid values, the threshold rule is invalid. Invalid threshold rules are ignored. actionparameter-keyword This keyword allows the administrator to specify the object or address to perform the action on. If the action-value is "program" or "note", this keyword and its accompanying value are required for a threshold rule to be valid. Invalid threshold rules are ignored. If an action-value is "none" or "clear", this keyword and its accompanying value are ignored if they were specified in the threshold rule. actionparameter-value The following table explains the parameters required for each action.
TABLE 2
______________________________________
Action Parameter Values
Action-
Value Action Parameter-value
______________________________________
none N/A. If a value is specified, it is skipped.
clear NIA. If a value is specified, it is skipped.
program
Fully-qualified program name. If needed by the
program, parameters to the program should follow the
first blank space after the fully-qualified program name.
note E-mail address. If desired by the administrator,
information to append to the note should follow the first
blank space after the e-mail address.
______________________________________
Tab characters in the value will be changed into blank spaces. If the action keyword has a value of "program" or "note" and if the actionparameter-value is not specified, the threshold rule is invalid. Invalid threshold rules are ignored. logfile-keyword Allows the administrator to specify a file name in which to log a record when a threshold rule has been triggered. This keyword is optional. If this keyword is not specified as part of a threshold rule, no log record will be written. logfile-value The logfile value requires a fully-qualified file name. The directory must already exist and be readable and writable by the uid and gid under which the web server is running. If specified and the threshold rule matches, a log record for the threshold will be written to the file. The log record has a predefined format. Anything after the file name will be appended to the end of the record (e.g., a miscellaneous column). Tab characters in the value will be changed into blank spaces. Additional Threshold File Format Rules All string values in a threshold rule are case sensitive. The following string values can be defined in a threshold rule: urlpath-value(s) dceusername-value(s) actionparameter-value logfile-value The following value must be specified as an integer between 0 and the maximum integer value defined for the target platform: triggervalue-value The following values allow regular expressions, as defined by the regcomp expression rules: urlpath-value(s) dceusername-value(s) Keywords in the threshold file are not case sensitive. The keywords supported are: trigger triggercomparison triggervalue urlpath dceusername action actionparameter logfile As trigger-values, the following keywords are not case sensitive: urlcounter bytecounter pagecounter failedlogincounter As action-values, the following keywords are not case sensitive: none clear program note The following describes one particular exemplary embodiment of the invention be should not be construed as limiting. Each keyword may be preceded by zero to many blank characters. It can be followed by zero to many blank characters. An equal sign comes afterwards followed by zero to many blank characters. Lastly, a value for the keyword is specified. Keyword and value assignments preferably do not span multiple lines. Comments in the threshold file preferably begin with a "#" or ";" as their first non-blank text. Keyword lines preferably do not contain comments. Comments and blank lines are preferably ignored. Note that comments that an administrator may make manually in a file may be overwritten or moved by the account manager. Quotation marks in a value typically are not parsed to treat an entire value between the quotation marks as a single value. For example, the value, "This file", is treated as two values: (1) "This and (2) file. Invalid lines are preferably ignored, such as a line having an invalid keyword name or no value at all. If a threshold rule does not have all its required values, the entire threshold rule preferably is ignored. Threshold rules that are not valid are preferably ignored. When the account manager plug-in is initialized, it will log threshold rules that were valid and rules that were not valid along with their error. These threshold log summary records are stored in a AccountManagerLoadSummaryFile file name defined in the account manager configuration file. If the AccountManagerLoadSummaryFile is not specified in the account manager configuration file, the results of the account manager's loading of the threshold rules preferably are not logged. Inside a threshold rule section, if a keyword and value pair is specified more than once, the last valid keyword and value pair in the rule will be used. In the preferred embodiment, the order of threshold rules in the file may control processing. For example, the first one encountered for the monitored resource that matches the comparison will have its action executed. The remaining threshold rules may not be checked if one has already been triggered. However, the administrator can specify the threshold match keyword in the configuration file to trigger all matching threshold rules, and not just the first matching rule. Preferably, a threshold rule cannot have the same title within the same monitored resource rule set. For example, two threshold rules with the same title preferably cannot have the same trigger-value, such as urlcounter. The two threshold rules could have the same title and have different trigger-values. Although allowed under these circumstances, the administrator is advised to keep the titles of each rule unique to reduce confusion. If the account manager cannot access the log file specified in a threshold rule for reading or writing, usually no log record will be written, but the account manager will still initiate the action, if any, defined for the threshold rule. If urlpath and/or dceusername values are specified, the threshold rule preferably must meet the conditions imposed by the triggervalue, urlpath, and dceusername in order to be triggered. Sample Threshold File The following is a sample threshold file.
______________________________________
# This is a sample threshold file - /usr/dfsweb/account/threshold
# Send a note to the administrator when the sensitive
# web page is accessed and log the action in the
# /usr/dfsweb/account/log/triggered.sub.-- rules file.
# Note that the "http:/ is not included as part of the urlpath value.
#
[Sensitive Web Page - /... /sensitive.html]
trigger = urlcounter
triggercomparison = >
triggervalue = 0
urlpath = /.../sensitive.html
action = note
actionparameter = webadministrator@austin.com
logfile = /usr/dfsweb/account/log/triggered.sub.-- rules
#
# Log a record in /usr/dfsweb/log/advertising whenever a URL that
# begins with /dfs/advertising/ is accessed. Note the ".*". not "*"
# indicates that one or more of any character may follow
# "/dfs/advertising/".
#
[Log access to /dfs/advertising/.*]
trigger = pagecounter
triggercomparison = >
triggervalue = 0
urlpath = /dfs/advertising/.*
action = none
logfile = /usr/dfsweb/log/advertising
#
# Run a popup program if 1000000 bytes or more are
# accessed by a user before the counter is reset.
# Also log the action in the
# /usr/dfsweb/account/log/triggered.sub.-- rules file.
#
[Alert popup for accounts accessing one million bytes or more]
trigger = bytecounter
triggercomparison = > =
triggervalue = 1000000
action = program
actionparameter = /usr/bin/alert.sub.-- popup.sh
logfile = /usr/dfsweb/account/log/triggered.sub.-- rules
#
# Log a record in /usr/dfs/web/log/pagehogs if a user with a
# dceusername of bob or bill accesses more than 500 pages before the
# counter is reset.
#
[Log users accessing more than 500 pages]
trigger = pagecounter
triggercomparison = >
triggervalue = 500
dceusername = bob bill
action = none
logfile = /usr/dfsweb/log/pagehogs
#
# Run a paging program if a user has 10 or more failed login attempts.
#[Run paging program if 10 or more failed logins]
trigger = failedlogincounter
triggercomparison = > =
triggervalue = 10
action = program
actionparameter = /usr/bin/pager 555-1212
______________________________________
As noted above, preferably the account manager derives values for its monitored resources through the name/value pairs passed to it by the web server. Also, the server will communicate login information to the Account Manager through this same name/value structure. The flowchart shown in FIG. 5 illustrates the steps followed to determine whether or not a resource should be monitored and threshold rules triggered. At step 71, a test is made to determine whether the transaction refers to the distributed file system (DFS). This will be the case is the following name and value pairs are true: rq.fwdarw.reqpb: name="path" value=(starts with "/. . . ", "/.:" or "/:") If the outcome of the test at step 71 is negative, the database counter value may still be updated and threshold rules checked if the autoadd value is set to "on" for the corresponding managed resource. At step 72, assuming the outcome of the test at step 71 was positive, a test is made to determine if the transaction is a failed DCE login. If the following name and value pairs are not true, the DCE login is successful: rq.fwdarw.srvhdrs: name="status" value="401 Unauthorized"(just check for "401" at front) rq.fwdarw.vars: name="DCE-VALID" value="-1" If the above name and value pairs were true, indicating a negative outcome of the test at step 72, the routine increments the failed login counter for the user at 74 if the failed login counter is being monitored, checks at step 76 to see if any threshold rules have been triggered, and returns successfully. The DCE user name can be determined from the following name and value pair. rq.fwdarw.vars: name="DCE-NAME" value=(user-name). If the outcome of the test at step 72 was positive, the routine continues at step 78 to determine if the DCE credential is valid. (Note that for performance reasons the failed logon counter for the auth-user will not be reset if a transaction is valid. Preferably, a failed login record can only be reset manually by the administrator or automatically through the Resetinterval DCE Web configuration value.) If the following name and value pair is true, the DCE login is valid. rq.fwdarw.vars: name="DCE-VALID" value="1" At step 80, the DCE user name is retrieved from the following name and value pair: rq.fwdarw.vars: name="auth-user" value=(DCE user name) (It should be noted that the "auth-user" name is different from the "DCE-NAME" name. "DCE-NAME" is only available if the DCE login failed). At step 82, a test is made to determine whether the transaction was successful, which is indicated by any of the following name and value pairs, for example: rq.fwdarw.srvhdrs: name="status" value="200 OK"(just check for "200" at front) rq.fwdarw.srvhdrs: name="status" value="304 Use local copy"(just check for "304" at front) rq.fwdarw.srvhdrs: name="status" value="302 Found" (just check for "302" at front) If any of the above name and value pairs were true, the routine continues at step 84 to increment the appropriate counters for the resource if the resource is being monitored, checks at step 86 to see if any threshold rules have been triggered, and returns successfully. The monitored values can be determined from the following name and value pairs.
______________________________________
rq-->reqpb:
name="path" value=(path name)
rq-->vars:
name="auth-user"
value=(DCE user name)
rq-->srvhdrs:
name="content-length"
value=(page size in bytes)
______________________________________
Note that the "auth-user" value is never normalized to the full DCE account name. Whatever is passed to the Account Manager will be stored in the database. The routine then returns to complete the name/value pair processing. DFS Web Configuration File Preferably, the account manager includes or has associated therewith a configuration file (called DFS Web configuration file) that stores startup values read in by the account manager when the plug-in is loaded or reloaded by the server. The fully-qualified file name to the configuration is passed in as a name-value parameter to the account manager when it is initialized by the Web server. Preferably, loaded configuration values must be valid, otherwise no resources will be monitored and thus no threshold rules can be triggered. To determine if a DFS Web configuration file is valid, the administrator must examine the load summary file after starting the server or the routine stdout when starting the server. Account Manager Configuration Format The format of the Account Manager section of the DFS Web configuration file is defined as follows: [AccountManager] ThresholdSourceFile=filename ThresholdMatch={first.vertline.all} AccountManagerLoadSummaryFile=filename Resetinterval=interval-seconds URLCounterDatabase={file.vertline.dbm.vertline.none} URLCounterAutoAdd={on.vertline.off} URLCounterReset={never.vertline.interval} URLCounterFile=filename PageCounterDatabase={file.vertline.dbm.vertline.none} PageCounterAutoAdd={on.vertline.off} PageCounterReset={never.vertline.interval} PageCounterFile=filename ByteCounterDatabase={file.vertline.dbm.vertline.none} ByteCounterAutoAdd={on.vertline.off} ByteCounterReset={never.vertline.interval} ByteCounterFile=filename FailedLoginCounterDatabase={file.vertline.dbm.vertline.none} FailedLoginCounterAutoAdd={on.vertline.off} FailedLoginCounterReset={never.vertline.interval} FailedLoginCounterFile=filename Each of the monitored resources are represented in the DFS Web configuration file: URLCounter, PageCounter, ByteCounter, and FailedLoginCounter. The specific parameters to each resource are defined as follows: Database--{file.vertline.dbm.vertline.none} The options correspond to the storage of records relating to the resource via ASCII file storage, storage through the dbm interface, or no storage at all. If "none" is specified, the resource will not be monitored. This is equivalent to not including the monitored resource keyword group in the configuration file. The default is none. AutoAdd--{on.vertline.off} Tells the account manager whether or not to automatically add records to the corresponding monitored resource database if the user has not logged onto DCE through the session manager. The account manager will search for the DCE-VALID keyword in its parameter block. If the DCE-VALID keyword exists and its value is 1, the account manager will assume that the user has successfully logged onto DCE. Turning AutoAdd on will log all user actions, whether or not the user has successfully logged into DCE yet. The default is off. CounterReset--{never.vertline.interval} If "never" is specified, the administrator must manually reset the counter for an individual record or the counters for all the records of the managed resource. This can be done, for example, through an administrative web page. If "interval" is specified, the counter for the records belonging to the managed resource will be reset to 0 when a transaction on the managed resource occurs and the current time has passed the last reset time for the record plus the ResetInterval, which is specified in seconds. The default is never. File-fully-qualified file name to the ASCII file or dbm where the records for the corresponding managed resource are stored. The directory must already exist and be readable and writable by the uid and gid under which the web server is running..vertline.f the file exists, it must be readable and writable by the uid and gid under which the web server is running. This keyword does not have a default. If it is not specified, the resource will not be monitored. If the account manager cannot access the specified file for reading or writing, the resource will not be monitored. If the Database keyword value is not set to none and a File keyword value is not specified, the entire configuration is invalid. The Database and File keywords for a monitored resource must be specified or the resource will not be monitored. The file names for each defined monitored resource must be different. if any of the database file names are the same, the entire configuration is invalid. The remaining account manager keywords are defined as follows: ThresholdSourceFile-fully-qualified file name to the threshold rules definition file. The file must already exist and be readable by the uid and gid under which the web server is running. The default is not to have a threshold file and thus no threshold rules. If the threshold source file is specified, but cannot be loaded, the entire configuration is invalid. If the threshold source and load summary files have the same file names, the entire configuration is invalid. ThresholdMatch--{first.vertline.all}. When a Web transaction occurs, the value of this keyword indicates if only the first matching threshold rule should be triggered or if all matching threshold rules should be triggered. As mentioned in the threshold rules description, only thresholds belonging to resources that are actively monitored are checked. The threshold rules are checked in the order that they were loaded from the threshold rules file. If the value is "all" the administrator can define multiple rules for a monitored resource with the same triggercomparison and trigger value. Once the threshold condition was met, all the matching threshold rules would be triggered in the order they were loaded from the threshold file. If the administrator defined multiple rules for a monitored resource with the same triggercomparison and trigger value and the ThresholdMatch keyword was set to "first," only the first matching threshold rule would be triggered. The default is "first." If the value for the keyword is invalid in the configuration file, it will be set to "first." AccountManagerLoadSummaryFile-fully-qualified file name to the file where the results of the account manager's loading of the threshold file will be stored. This file will also contain a list of the monitored resources. If this file already exists, additional log records will be appended to it. This file must be readable and writable by the uid and gid under which the web server is running. The default is not to log the results of the account manager's loading of the configuration and threshold files. If the account manager cannot read a specified AccountManagerLoadSummaryFile it will log an error to stdout and the web server log. Whether or not the Account Manager logs records to an AccountManagerLoadSummaryFile, it will log the same information to stdout. ResetInterval-rest time in seconds. This keyword is used by monitored resources to determine when to set their record counters back to 0 if their *CounterReset keyword is set to "interval". Valid values are between 0 and 2678400 (31 days). The default is 0, which equates to not resetting the value. A reset for a database record based on the ResetInterval value will not trigger any threshold rules. Additional DFS Web Configuration File Format Rules All string values in a configuration file are case sensitive. For the account manager section, all file names are string values and are thus case sensitive. The following value must be specified as an integer between 0 and 2678400 (31 days): interval-seconds Keywords in the configuration file are not case sensitive. The keywords supported are: AccountManagerLoadSummaryFile ThresholdSourceFile ThresholdMatch Resetinterval URLCounterDatabase URLCounterAutoAdd URLCounterReset URLCounterFile PageCounterDatabase PageCounterAutoAdd PageCounterReset PageCounterFile ByteCounterDatabase ByteCounterAutoAdd ByteCounterReset ByteCounterFile FailedLoginCounterDatabase FailedLoginCounterAutoAdd FailedLoginCounterReset FailedLoginCounterFile As Database values, the following keywords are not case sensitive: file dbm none As AutoAdd values, the following keywords are not case sensitive: on off As Reset values, the following keywords are not case sensitive: never interval The following describes some additional features of a preferred exemplary embodiment although again it should be appreciated that the following should not be taken to limit the present invention. Even though the account manager can default all its values, the "[Account manager]" section is typically present in the configuration file. If not, the file is not considered a valid configuration file. All keywords in the configuration file are preferably unique. For example, a non-account manager section preferably cannot have a Resetinterval keyword since the account manager section already uses it. Each keyword can be preceded by zero to many blank characters. The keyword can be followed by zero to many blank characters. An equal sign preferably must come afterwards followed by zero to many blank characters. Lastly, a value for the keyword preferably must be specified. Preferably, keyword and value assignments do not span multiple lines. Comments in the threshold file preferably begin with a "#" or ";" as their first non-blanket text. Preferably, keyword lines do not contain comments. Comments and blank lines are preferably ignored. Note that comments that an administrator may make manually in a file may be overwritten or moved by the account manager. Quotation marks in a value typically are not parsed to treat an entire value between the quotation marks as a single value. For example, the value, "This file", is treated as two values: (1) "This and (2) file". Invalid lines are preferably ignored. Monitored resource rules that are not valid are preferably ignored. When the account manager plug-in is initialized, it will print to stdout the account manager configuration keywords that were valid and those that were not. This information will also be stored in the AccountManagerLoadSummaryFile file name, if defined in the configuration file. If the account manager cannot access the file for writing, the results of the account manager's loading of the configuration file typically will not be recorded. Inside the account manager section of the configuration file, if a keyword and value pair is specified more than once, the last valid keyword and value pair in the rule typically will be used. If more than one account manager section is defined in a configuration file, preferably only the values for the first section will be used. All subsequent redefinitions of the account manager section in the configuration file preferably will be ignored. Installation and Configuration of the Account Manager Plug-in To install the account manager plug-in, an Installation and Configuration program will need to modify the workstation web server configuration file as well as install the DFS Web configuration and threshold files on the target workstation. Configuration of Netscape To use the account manager plug-in with a Netscape web server, the installation and configuration program of the product will need to include the following lines in the initial portion of the Netscape server obj.conf file:
______________________________________
Init fn="load-modules" shlib="/usr/lib/libdfswebamgr.a"
func="dwbamgr-init,dwbamgr-log
Init fn=dwbamgr-init" cfgfile="/usr/dfsweb/dfsweb.cfg"
______________________________________
The first line indicates that the account manager shared library, /usr/lib/libdfswebamgr.a, should be loaded upon server startup and that the dwbamgr-init and dwbamgr-log functions in the shared library should be externalized. Note that the shared library path is fully-qualified. The second line indicates that the dwbamgr-init function should be called when the server is started and that the cfgfile keyword and value should be passed in. The value for the cfgfile should be the fully-qualified path to the DFS Web configuration file. The installation and configuration program of the product will also need to include the following line in the <object> section of the Netscape server obj.conf file: AddLog fn="dwbamgr-log" The Add Log line indicates that the dwbamgr-log function should be called when a Netscape web transaction reaches the AddLog stage. If there are any problems with the syntax of the DFS Web configuration file or Threshold file, the lines read in by the Account Manager and the errors associated with the invalid lines will be logged to the AccountManagerLoadSummaryFile. The Account Manager will also store the results of validating the DFS Web configuration file and Threshold file in the AccountManagerLoadSummaryFile. If the DFS Web configuration file cannot be found or read, the Account Manager will log an error to stdout and the web server log file. If the AccountManagerLoadSummaryFile file cannot be found or read, the Account Manager will log an error to the web server log file. Note that if the web server has not yet read in its value for its log file during the web server initialization process, the web server will send the log message to stdout instead. Configuration of DFS Web Configuration and Threshold Files The installation and configuration program for the product will need to ask the administrator a number questions in order to create the DFS Web configuration file and threshold file. The Account Manager portion of the DFS Web product directory defaults to /usr/lpp/dfsweb/etc/<servername>. This directory is abbreviated to $DFSWEB. <servername> is the name of the web server into which the DFS Web product is being installed and configured. The configuration file will be stored in $DFSWEB/dfsweb.cfg. The configuration file is required for the account manager plug-in even if the administrator does not want to monitor any resources. The threshold file will be stored in $DFSWEB/dfsweb.thr. The administrator can add additional rules either manually or through the DFS Web Administrator graphical user interface at a later time. This template threshold rule file helps establish the threshold file with the web server for future additions. Configuration File Template To fill out the values in the configuration file template and install the file on the administrator's workstation, the installation and configuration program for the product will need to ask the administrator for responses to prompts, such as the following: What is the fully-qualified file name of the Account Manager Load Summary File? (Options: nil or fully-qualified file name) (default $DFSWEB/loadsummary) What is the reset interval in seconds for counters of monitored resources? (range: 0-2678400) (default 0) Monitor the URLCounter? If yes, what is the fully qualified database file name? (required) (default $DFSWEB/dburl) If yes, should non-DFS Web transactions be monitored? (options: on off) (default off) 1. Set the URLCounterDatabase value to dbm. 2. If the reset interval is not 0, set the URLCounterAutoAdd value to interval. 3. If the reset interval is 0, set the URLCounterAutoAdd value to never. If no, set the Database value to none. The previous question is also asked for the other monitored resources. Responses to the prompts will be used to fill out the ??? marks in the following template configuration file. Note that the $DFSWEB in the template file will be expanded to the fully-qualified path to the DFS Web product directory. # Install/Config DFS Web Configuration File Template # DFS Web Product--$DFSWEB/dfsweb.cfg # You can edit this file, but comments and formatting changes # might be lost when the DFS Web product makes changes. [AccountManager] AccountManagerLoadSummaryFile=??? ThresholdSourceFile=$DFSWEB/dfsweb.thr ThresholdMatch=??? ResetInterval=??? URLCounterDatabase=??? URLCounterAutoAdd=??? URLCounterReset=??? URLCounterFile=??? PageCounterDatabase=??? PageCounterAutoAdd=??? PageCounterReset=??? PageCounterFile=??? PageCounterDatabase=??? PageCounterAutoAdd=??? PageCounterReset=??? PageCounterFile=??? ByteCounterDatabase=??? ByteCounterAutoAdd=??? ByteCounterReset=??? ByteCounterFile=??? FailedLoginCounterDatabase=??? FailedLoginCounterAutoAdd=??? FailedLoginCounterReset=??? FailedLoginCounterFile=??? Sample DFS Web Configuration File The following is a sample DFS Web configuration file: # Install/Config DFS Web Configuration File # DFS Web Product-/usr/lpp/dfsweb/etc/graywolf/dfsweb.cfg # You can edit this file, but comments and formatting changes # might be lost when the DFS Web product makes changes. [Account Manager] ThresholdSourceFile=/usr/lpp/dfsweb/etc/graywolf/dfsweb.thr ThresholdSourceFile=/usr/lpp/dfsweb/etc/graywolf/dfsweb.thr ThresholdMatch=first AccountManagerLoadsummaryfile=/usr/lpp/dfsweb/etc/graywolf/loadsummary URLCounterDatabase-dbm URLCounterAutoAdd=on URLCounterReset=never URLCounterFile=/usr/lpp/dfsweb/etc/graywolf/dburl PageCounterDatabase=dbm PageCounterAutoAdd=on PageCounterReset=never PageCounterFile=/usr/lpp/dfsweb/etc/graywolf/dbpage ByteCounterDatabase-dbm ByteCounterAutoAdd=on ByteCounterReset=never ByteCounterFile=/usr/lpp/dfsweb/etc/graywolf/dbbyte FailedLoginCounterDatabase=dbm FailedLoginCounterAutoAdd=on FailedLoginCounterReset=never FailedLoginCounterFile=/usr/lpp/dfsweb/etc/graywolf/dbfailed Threshold File Template To fill out the values in the threshold file template and install the file on the administrator's workstation, the installation and configuration program for the DFS Web product will ask the administrator for responses to prompts, such as the following: What action should be taken if there are too many failed logins?(options: none, counter, program, note) (default none) If the action is none, the trigger value should be 10. Remaining variable values will be set to nil. If the action is not none, what should the trigger value be for the number of failed logins? (range: 0-MAX.sub.-- INT) (default 10) If the action is not none, what fully-qualified log file name should be used to record failed login attempts? (default nil) If the action is clear, set the action parameter to nil. If the action is program, what program should be run with what parameters? (required) If the action is note, what email address should mail be sent to with what text? (required) Whatever the action, what fully-qualified log file name should store records of this triggered threshold? (options: nil or fully-qualified file name) (default $DFSWEB/thresholdlog) Responses to the prompts will be used to fill out the ??? marks in the following template threshold file. Note that the $DFSWEB in the template file will be expanded to the fully-qualified path to the DFS Web product directory. # Install/Config DFS Web Threshold File Template # DFS Web Product-$DFSWEB/dfsweb.thr # You can edit this file, but comments and formatting changes # might be lost when the DFS Web product makes changes. [Too many failed logins] trigger=failedlogincounter triggercomparison=> triggervalue=??? action=??? actionparameter=??? logfile=??? Sample Load Summary File The following is a sample load summary file. The file shows the lines read in from the configuration and threshold files and how the Account Manager processes them.
__________________________________________________________________________
****************************************
***
Reading DFS Web Configuration file
"/usr/lpp/dfsweb/etc/graywolf/dfsweb.cfg"
****************************************
> #
Install/Config DFS Web Configuration File Template
> #
DFS Web Product - /usr/lpp/dfsweb/etc/graywolf/dfsweb.cfg
> #
You can edit this file, but comments and formatting changes
> #
might be lost when the DFS Web product makes changes.
>
> [Account Manager]
>
> AccountManagerLoadSummaryFile =
/usr/lpp/dfsweb/etc/graywolf/loadsummary
Keyword = "AccountManagerLoadSummaryFile", Value =
"/usr/lpp/dfsweb/etc/graywolf
> ThresholdSourceFile = /usr/lpp/dfsweb/etc/graywolf/dfsweb.thr
Keyword = "ThresholdSourceFile", Value =
"/usr/lpp/dfsweb/etc/graywolf/dfsweb.
> ThresholdMatch = first
Keyword = "ThresholdMatch", Value = "first"
> ResetInterval = 0
Keyword = "ResetInterval", Value = "0"
>
> URLCounterDatabase = dbm
Keyword = "URLCounterDatabase", Value = "dbm"
> URLCounterAutoAdd = 0
Keyword = "URLCounterAutoAdd", Value = "on"
> URLCounterReset = never
Keyword = "URLCounterReset", Value = "never"
> URLCounterFile = /usr/lpp/dfsweb/etc/graywolf/dburl
Keyword = "URLCounterFile", Value =
"/usr/lpp/dfsweb/etc/graywolf/dburl"
>
> PageCounterDatabase = dbm
Keyword = "PageCounterDatabase", Value = "dbm"
> PageCounterAutoAdd = on
Keyword = "PageCounterAutoAdd", Value = "on"
> PageCounterReset = never
Keyword = "PageCounterReset", Value = "never"
> PageCounterFile = /usr/lpp/dfsweb/etc/graywolf/dbpage
Keyword = "PageCounterFile", Value =
"/usr/lpp/dfsweb/etc/graywolf/dbpage"
>
> ByteCounterDatabase = dbm
Keyword = "ByteCounterDatabase", Value = dbm"
> ByteCounterAutoAdd = on
Keyword = "ByteCounterAutoAdd", Value = "on"
> ByteCounterReset = never
Keyword = "ByteCounterReset", Value = "never"
> ByteCounterFile = /usr/lpp/dfsweb/etc/graywolf/dbbyte
Keyword = "ByteCounterFile", Value =
"/usr/lpp/dfsweb/etc/graywolf/dbbyte"
>
> FailedLoginCounterDatabase = dbm
Keyword "FailedLoginCounterDatabase", Value =dbm"
> FailedLoginCounterAutoAdd = on
Keyword = "FailedLoginCounterAutoAdd", Value = "on"
> FailedLoginCounterReset = never
Keyword = "FailedLoginCounterReset", Value = "never"
> FailedLoginCounterFile = /usr/lpp/dfsweb/etc/graywolf/dbfailed
Keyword = "FailedLoginCounterFile", Value =
"/usr/lpp/dfsweb/etc/graywolf/dbfailed"
>
****************************************
***
Reading DFS Web Threshold File
/usr/lpp/dfsweb/etc/graywolf/dfsweb.thr
****************************************
>> #
Install/Config DFS Web Threshold File Template
>> #
DFS Web Product - /usr/lpp/dfsweb/etc/graywolf/dfsweb.thr
>> #
You can edit this file, but comments and formatting changes
>> #
might be lost when the DFS Web product makes changes.
>> #
>> [Too many failed logins]
>> trigger = failedlogincounter
keyword = "trigger", value = "failedlogincounter"
>> triggercomparison = =
>> keyword = "triggercomparison", value = "="
>> triggervalue = 10
keyword = "triggervalue, value = "10"
>> action = note
keyword = "action", value = "note"
>> actionparameter = shrader@austin.ibm.com 1 2 3
>> keyword = "actionparameter", value = "shrader@austin.ibm.com 1 2
3"
>> logfile = ?user/lpp/dfsweb/etc/graywolf/triggerlog
keyword = "logfile", value = "/usr/lpp/dfsweb/etc/graywolf/triggerlog"
>>
>> [Reset counter after too many failed logins]
****************************************
***
Validating Threshold Rule [Too many failed logins]
****************************************
WARNING: Count not obtain information on the Logfile
"/usr/lpp/dfsweb/etc/graywolf/trigger
File "/usr/lpp/dfsweb/etc/graywolf/triggerlog" may not exist yet.
***
Validation for threshold rule [Too many failed logins] at the end of
the
failed logincounter rule set
>> trigger = failedlogincounter
keyword = "trigger", value = "failedlogincounter"
>> triggercomparison = >
keyword = "triggercomparison", value = ">"
>> triggervalue = 10
keyword = "triggervalue", value = "10"
>> action = clear
keyword = "action", value = "clear"
>> logfile = /usr/lpp/dfsweb/etc/graywolf/triggerlog
keyword = "logfile", value = "/usr/lpp/dfsweb/etc/graywolf/triggerlog"
****************************************
***
Validating Threshold Rule [Reset counter after too many failed
logins]
****************************************
WARNING: Could not obtain information on the Logfile
"usr/lpp/dfsweb/etc/graywolf/trigger
File "/usr/lpp/dfsweb/etc/graywolf/triggerlog: may not exist yet.
***
Validation for threshold rule [Reset counter after too many failed
logins]
added at
end of failed login
****************************************
***
Added threshold rule id 2 with name [Reset counter after too many
failed logins]
****************************************
****************************************
***
Validating DFS Web Configuration File
****************************************
***
Validation of DFS Web configuration file ended with 0 errors and 0
warnings.
****************************************
***
DFS Web Configuration File Values
****************************************
The configuration file passed validation.
Configuration file name = /usr/lpp/dfsweb/etc/graywolf/dfsweb.cfg
Configuration file last modified time = Thu Nov 14 18:30:15 1996
Load summary file name = /usr/lpp/dfsweb/etc/graywolf/loadsummary
Reset interval = 0 seconds (no automatic reset performed)
+++ Thresholds active +++
Number of thresholds rules = 2
Only the first matching threshold triggered.
Threshold file name = /usr/lpp/dfsweb/etc/graywolf/dfsweb.thr
Threshold file last modified time = Thu Nov 14 15:31:19 1996
** UrlCounter Values ** MONITORED
Database = dbm
AutoAdd = on
Reset = never
Database file name = /usr/lpp/dfsweb/etc/graywolf/dburl
** PageCounter Values ** MONITORED
Database = dbm
AutoAdd = on
Reset = never
Database file name = /usr/lpp/dfsweb/etc/graywolf/dbpage
** ByteCounter Values ** MONITORED
Database = dbm
AutoAdd = on
Reset = never
Database file name = /usr/lpp/dfsweb/etc/graywolf/dbbyte
** FailedLoginCounter Values ** MONITORED
Database = dbm
Autoadd = on
Reset = never
Database file name = /usr/lpp/dfsweb/etc/graywolf/dbfailed
***
The DFS Web Configuration file
"/usr/lpp/dfsweb/etc/graywolf/dfsweb.cfg" passed validation.
***
URLCounterDatabase monitored in file
"/usr/lpp/dfsweb/etc/graywolf/dburl". **
***
PageCounterDatabase monitored in file
"/usr/lpp/dfsweb/etc/graywolf/dbpage".
***
ByteCounterDatabase monitored in file
"/usr/lpp/dfsweb/etc/graywolf/dbbyte".
***
FailedLoginCounterDatabase monitored in file
"/usr/lpp/dfsweb/etc/graywolf/dbfailed
***
The DFS Web threshold file is
"/usr/lpp/dfsweb/etc/graywolf/dfsweb.thr". ***
***
Transactions will be monitored against 2 threshold rules.
__________________________________________________________________________
***
One of the preferred implementations of the account manager of the invention is as a set of instructions (program code) in a code module resident in the random access memory of the computer. Until required by the computer, the set of instructions may be stored in another computer memory, for example, in a hard disk drive, or in a removable memory such as an optical disk (for eventual use in a CD ROM) or floppy disk (for eventual use in a floppy disk drive), or downloaded via a computer network. In addition, although the various methods described are conveniently implemented in a general purpose computer selectively activated or reconfigured by software, one of ordinary skill in the art would also recognize that such methods may be carried out in hardware, in firmware, or in more specialized apparatus constructed to perform the required method steps. Further, although the invention has been described in terms of a preferred embodiment in a specific distributed file system environment, those skilled in the art will recognize that the invention can be practiced, with modification, in other and different hardware and operating system architectures with the spirit and scope of the appended claims. Moreover, implementation in OSF DCE is not a requirement of the present invention either. Additional variations and modifications of the account manager operations are also within the scope of this invention. Thus, for example, the account manager may support a configuration option that allows the triggering of all threshold rules that match a web transaction, not just the first one that matches. In addition, the account manager GUI may provide web administration pages for the viewing of database records, administration of database records, and definition of threshold actions. The account manager may provide support for predefined substitutions in the parameter value of threshold rules (e.g., % dceusername, % date, % yr1), provide support for the threshold actions of enabling and disabling registry accounts, provide a command line interface for monitored resource database query and resetting, support ASCII files as a database medium, support a dcegroupname filter as part of a threshold rule definition, store the client ip address with the dce user name for a failed login record, support the preservation of comments throughout the threshold and configuration files, and support the definition of threshold rules that can be triggered on server errors. Of course, it may also be desirable to add additional monitored resources, add additional database mediums (such as SQL, DFS or the DCE registry) for supporting the resource information, provide support for compound monitored thresholds (e.g. dceusername=fred && bytecounter>10000), add additional threshold actions (such as SNMP traps), and the like. All of these variations and modifications are deemed to be within the scope of the present invention.
|
Same subclass Same class Consider this |
||||||||||