| Title: | VAX and Alpha VMS |
| Notice: | This is a new VMSnotes, please read note 2.1 |
| Moderator: | VAXAXP::BERNARDO |
| Created: | Wed Jan 22 1997 |
| Last Modified: | Fri Jun 06 1997 |
| Last Successful Update: | Fri Jun 06 1997 |
| Number of topics: | 703 |
| Total number of notes: | 3722 |
Hi, Does any one have a workaround / solution to reducing the size of the audit jornal file. It seems that set audit/server=new_log will allocate the biggest file that it ever use. The problem is that one of my customer is using 600,000 thousand block and creating a new file increase the usage rather than release disk space because it create a new file of 600,000 blocks on top of the current existing Directory SYS$COMMON:[SYSMGR] SECURITY.AUDIT$JOURNAL;4 1/14632 <--- how to reduce this initial allocation Regards, YongLee
| T.R | Title | User | Personal Name | Date | Lines |
|---|---|---|---|---|---|
| 610.1 | Change threshold settings | GIDDAY::GILLINGS | a crucible of informative mistakes | Mon May 19 1997 03:39 | 19 |
YongLee,
See VMSNOTES_V11 note 2139 and VMSNOTES_V10 1643
2139.1>$ SET AUDIT /JOURNAL=SECURITY /THRESHOLD=WARN=200
Failing that, I think you can also do it by stopping the audit servers
across the cluster, deleting VMS$AUDIT_SERVER.DAT and any journal files,
then restarting audit servers. Think carefully before doing this as you
will lose any non default security settings (use SHOW AUDIT/ALL to find
any customised settings).
John Gillings, Sydney CSC
| |||||
| 610.2 | This works for me | MOVIES::16.196.144.83::brockbank | Mon May 19 1997 07:52 | 15 | |
Hi YongLee, I have found doing $ set audit/journal/destination=sys$manager:security.audit$journal causes the audit server to create a new version of the journal file. The old version (ie sys$manager:security.audit$journal;-1) can then be saved somewhere out of the way and its space reclaimed. I've only done this on a standalone node; I don't know if it will work for a cluster or if there is some extra magic incantation needed in that case. Ian Brockbank | |||||
| 610.3 | reply | ZPOVC::YONGLEE | Thu May 22 1997 06:57 | 6 | |
Hi,
Thanks for the reply ...
Regards,
YongLee
| |||||