Replicate Log Files on Linux

[allann]

We need to submit log paths for Replicate activity such as authentication/logon checks, user permission changes, system events, account management, and other server activity. We have our instance installed on Linux. I see that there are repsrv and repcmd log files. What's the main difference between the two?

[Nanda_Ravindra · Accepted solution]

@allann  repcmd log file is generated for every repctl command that is run and the repsrv log is the server log that shows all the activities. 

Thanks,

Nanda

[allann]

Thanks for the quick response. Does the repsrv log show all administrator activity?

[Steve_Nguyen]

@allann , the repsrv log have activity , such as task stop , start, error, not sure what administrator activity are you looking for. 

[allann]

logon authentication, admin changes settings, changes to accounts includes done by admin or user themselves, object access, failed logons.

[shashi_holla]

Hi @allann 

To check more on the authentication/user logon errors, the log file we should be checking is repuictl which will have authentication details.

system events, account management, and other server activity

repsrv log will have these details.

Thank you,

[Steve_Nguyen · Accepted solution]

@allann , look like you are looking for auditing, this is more of Qlik Enterprise manager, QEM , see user guide :

https://help.qlik.com/en-US/enterprise-manager/November2022/Content/EnterpriseManager/Main/Servers/c...

[allann]

Yes, for Splunk requirements. This makes more sense. Thanks!

[Nanda_Ravindra · Accepted solution]

Adding to Steve's comments, if you are looking for auditing then Qlik enterprise is the one you should use. Please note that, in order to track the activities, all the transactions must be executed in Enterprise Manager to show up in the audit trail report in QEM.

Hope this helps!

Thanks,

Nanda

[allann]

Thanks Nanda. Is there a way to automate the auditing logs? From what I've found it's only manual on the UI.