Bigfix Audit file

Usage and Config Platform
1

Hello everyone,
I upgraded my BigFix version from 9.5.9 to 9.5.14.
Although the upgrade was successful the audit file in the server is still writing the data in the old format.
For example the logs in the files are written this way (version1):

1|Tue, 05 Sep 2017 10:57:06 -0700|INFO||||||user “johndoe” (1): Successful log in. (Data Connection)

And I want it to be written like this (version 2):

1|Tue, 05 Sep 2017 10:57:06 -0700|INFO|johndoe|CONSOLE|USER|PERMIT|172.28.128.5|Successful log in. (Data Connection)

I found in the help center that In case of audit entries other than those introduced in 9.5.11 or later, the messages are formatted like version1. But although I have a later version than 9.5.11 the data is still looks like version1.

So the question is:
How can I change the version of the logs? the second version of the log is much more detailed.

thank you:grinning:

1 Like
2

Hi,
yes, starting from the BigFix version 9.5.11, the server audit log introduces the new format of the messages.
In case of audit entries other than those introduced in 9.5.11 or later, the messages are formatted as follows: “<format-version>|<timestamp>|<message-priority>||||||<message>” .
For example:
1|Tue, 05 Sep 2017 10:57:06 -0700|INFO||||||user “testuser” (1): Successful log in. (Data Connection)
In other words the old messages use the new format, but don’t fill the new fields.
This is the audit log reference page