Our Audit Trail DB is 100 GB and the Audit Trail maintenance, which sometimes runs during business hours, is taking a toll on my LF VM application server. I am wondering if there is a way to separate the Audit Trail service from the application server. In doing so, I am hoping to take some of the load off the VM. If separating the service from the application server is not an option, is there a way to control when the AT maintenance takes place so that it does not run during business hours?
Question
Question
Answer
You can change the settings for where the Laserfiche server writes audit data in the Auditing node of the Administration Console, the relevant settings are "Audit file location" and "Rollover directory". These are per-repository settings, so you need to do it for each one.
That will cause LFS to write to the new location, but existing audit logs will stay put. You'll need to manually move those from their current location to the new one. You'll want to delete them from the "Rollover Logs" node, otherwise LFS will advertise to Audit Trail that it possesses audit data that it does not.
When you set up Audit Trail, you'll point it to the repositories and you'll point it to the folder(s) containing the old logs you copied. Do not point it to the active rollover folder, Audit Trail gets confused when it sees the same audit data available from multiple sources (LFS and the file system).
Replies
It's certainly possible to install Audit Trail on a different server than the one you have LFS installed on. They are installed by the same setup.exe, but you can choose which components you want to install on a particular machine. The Audit Trail service itself should not be using too much in the way of resources, but it's also possible to have Audit Trail to use a different SQL server than the one LFS is using and you might get more impact from this change.
I just want to get better clarification on this one.
I have multiple repositories spread across 5 application servers. What I am looking to do is create an audit server by moving everything audit related (i.e. audit engine, audit logs etc.), to this audit server. This would mean the application servers would write to the logs that are now housed on the audit server, and the audit service that is running on the audit server will handle everything audit related for all of our repositories.
is this possible and if so, is there any documentation on pointing everything to the one audit server?
Thanks Brian. That sounds like it will work.