You are viewing limited content. For full access, please sign in.

Question

Question

Audit Trail Settings

Audit Trail
Updated October 14, 2015
asked on October 14, 2015

We have a customer that has 2 different locations set for the Audit file location and the Rollover directory location.

I see that some of the logs are replicated in both the locations but after a while they stopped (Starting from 2014 July to 2015 March). 

To reconcile both the settings to the same path can we do the following:

Stop Audit Service

Change the Audit file location to match the rollover directory location.

Start the Audit Service.

Overwrite the new Audit log created with the one from the old location (because that has audit data).

My question is will the system allow us to overwrite the audit log or will we loose the data?

Why are there 2 different locations. I believe earlier there was only one path and we could just set the file size and age for it to create rollover logs.

0 0

Answer

SELECTED ANSWER
replied on October 14, 2015

The "audit file location" is for the log file that is currently being written to.  This file needs to be written to for every single action that occurs in the repository, so you want it on a fast local drive.  The "rollover directory" is where audit files are archived to when they reach the limits you specify.  You might want to put them on a different server, where storage costs are less.  And now that they have been rolled over, they will never be modified so that location can have a correspondingly different backup policy.

2 0

Replies

replied on October 14, 2015

You should not stop any services in the process of making your changes.  The Audit Trail Reporting Service is not involved in writing the audit logs.  Logs are written by LFS, but if you stop that service you can no longer configure it.

If you overwrite one of your logs you will lose the data in it.  LFS will not make 2 copies of the same file, I don't know how you would end up like that without someone copying files with Windows explorer.  You can't just move files around on disk, LFS needs to know where everything is so it can respond to the reporting service's requests for data to load.  Logs that are not represented in the list in the administration console will not have their data loaded into the reporting database.

0 0
replied on October 14, 2015

Thank you Brian, I will ask if the customer IT made the copy. Please can I know why there are 2 location options? Separate for rollover & audit log file?

0 0
replied on October 14, 2015

For convenience. You may want your current log on a fast, but maybe smaller, disk, while the inactive ones can be moved to a different one, possibly slower, for archival since they're less likely to be used.

0 0
SELECTED ANSWER
replied on October 14, 2015

The "audit file location" is for the log file that is currently being written to.  This file needs to be written to for every single action that occurs in the repository, so you want it on a fast local drive.  The "rollover directory" is where audit files are archived to when they reach the limits you specify.  You might want to put them on a different server, where storage costs are less.  And now that they have been rolled over, they will never be modified so that location can have a correspondingly different backup policy.

2 0
replied on October 14, 2015

Thank you Brian.

0 0
You are not allowed to follow up in this post.

Sign in to reply to this post.

Details
Related Posts
Loading ...