topic Re: audit server - security.audit$journal file size in Operating System - OpenVMS

audit server - security.audit$journal file size

Don Lennert — Mon, 14 Apr 2008 19:00:55 GMT

I am trying to create a smaller security.audit$journal file. It seems the default allocation size is almost 4.9 million blocks. I've looked over several articles about starting a new_log but they say the default is based on the size of previous logs. So I thought I'd just stop the audit server, rename the audit$journal file, move it to another drive, delete the renamed version, then start the audit server again. The newly created file was only slightly smaller than the original file. Any thoughts on how to create this file at about 1/3 to 1/2 its current size?
Thanks for any help you can provide.

Re: audit server - security.audit$journal file size

Jim_McKinney — Mon, 14 Apr 2008 19:34:11 GMT

Try the following (replace the 10000 with whatever size you'd like the file to start at - you might as well start with a value near as large as you expect it to get before you next roll it).

$ SET AUDIT /JOURNAL=SECURITY /THRESHOLD=WARN=10000
$ SET AUDIT /SERVER=NEW_LOG

Re: audit server - security.audit$journal file size

Wim Van den Wyngaert — Tue, 15 Apr 2008 09:24:57 GMT

Try stop audit, delete sys$manager:vms$audit_server.dat, start audit again, do settings of set audit again.

It must keep the size somewhere so it should be in that file. But note that all your settings of audit are lost !

Wim

Re: audit server - security.audit$journal file size

Wim Van den Wyngaert — Tue, 15 Apr 2008 09:42:59 GMT

Tested it on a 7.3 cluster and it work. The file is now very small.

Wim