- Community Home
- >
- Servers and Operating Systems
- >
- Operating Systems
- >
- Operating System - OpenVMS
- >
- Re: Is it possible to restart audit server to clea...
Categories
Company
Local Language
Forums
Discussions
Forums
- Data Protection and Retention
- Entry Storage Systems
- Legacy
- Midrange and Enterprise Storage
- Storage Networking
- HPE Nimble Storage
Discussions
Discussions
Discussions
Forums
Forums
Discussions
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
- BladeSystem Infrastructure and Application Solutions
- Appliance Servers
- Alpha Servers
- BackOffice Products
- Internet Products
- HPE 9000 and HPE e3000 Servers
- Networking
- Netservers
- Secure OS Software for Linux
- Server Management (Insight Manager 7)
- Windows Server 2003
- Operating System - Tru64 Unix
- ProLiant Deployment and Provisioning
- Linux-Based Community / Regional
- Microsoft System Center Integration
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Discussion Boards
Community
Resources
Forums
Blogs
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Printer Friendly Page
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-01-2008 12:33 PM
тАО05-01-2008 12:33 PM
After all the research IтАЩve done, this should not be problem. The command is SET AUDIT/SERVER=EXIT. Do I need to stop anything else?
Can I execute the command through SYSMAN after setting environment/cluster? Can I start the audit server in SYSMAN too?
I want piece of mind that I do need to shutdown another process and that this will not cause a problem when I start the audit server again
Solved! Go to Solution.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-01-2008 01:06 PM
тАО05-01-2008 01:06 PM
Re: Is it possible to restart audit server to clear opcom messages
A thread was on that exact topic
http://forums11.itrc.hp.com/service/forums/questionanswer.do?threadId=581282
See particularly what John Gillings says, and the procedure he posted.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-01-2008 01:46 PM
тАО05-01-2008 01:46 PM
SolutionThanks for your vote of confidence, but I don't think that's Lucie's real problem.
Lucie,
If you've already disabled the alarms, stopping the audit server won't stop the flood of messages - they've already been sent, they're just queued up on the way to being displayed by OPCOM. There are several places that queues of messages can form, and they can be exceptionally long.
Your problem is usually due to the very slow speed of OPA0. A very short action can generate numerous alarms, but they can take a relatively long time to display. If you've turned off the source, you may be able to just leave the system overnight to catch up.
It may be quicker to REPLY/DISABLE until the flood has drained. If there's a process logged in on OPA0 just type the command blind and wait a few minutes to see if the messages settle. If there is no process logged in, you can do it remotely with:
$ DEFINE/USER SYS$COMMAND OPA0:
$ REPLY/DISABLE
Since some types of audit can generate large numbers of messages, it's usually best to turn on AUDITs only for a short period, then analyze the audit journal to determine the level of traffic.
$ StartTime=F$TIME()
$ SET AUDIT/AUDIT/ENABLE=(whatever)
(wait a minute or so)
$ SET AUDIT/AUDIT/DISABLE=(same)
$ ANALYZE/AUDIT/OUT=file/SINCE="''StartTime'"
Now look at the size of the output file to see how many audits you got, and what type.
Enabling ALARMs is fine, but take into account the real output speed of your console. Maybe turn off SECURITY alarms on OPA0 to and use a terminal window instead.
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-02-2008 01:14 AM
тАО05-02-2008 01:14 AM
Re: Is it possible to restart audit server to clear opcom messages
can help the system catch up.
Purely Personal Opinion
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-02-2008 06:00 AM
тАО05-02-2008 06:00 AM
Re: Is it possible to restart audit server to clear opcom messages
- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
тАО05-02-2008 06:02 AM
тАО05-02-2008 06:02 AM