Audit Server - System Hangs

[Brown, Simon]

I am going slowly crazy and it's only Monday.

I have a program listening to the audit server via the set audit/listener option.

If the program hangs or loops or whatever then my AXP VMS 6.2 system hangs up (not a crash - a hang). All my terminal windows hang (2 or 3 sessions with PUTTY). I am hammering the system, generating thousands of log entries in just a few seconds to test the software I wrote.

Now I thought there was a DCL option I could use. I have the server's final-action set to purge_old. I just do not want my customer's systems to hang.

So help me! simon.brown@kns.ch :-)

[Wim Van den Wyngaert · Accepted solution]

1) make sure that your program that reads the mailbox will not get suspended (set aud/excl).

2) make sure quotas are high for audit_server (and the mailbox reader)

3) check set aud/backlog to do the config of when getting suspended

Wim

[Brown, Simon]

I agree with the excellent suggestions, but why does an idle terminal session logged in as System get suspended?

This is what I don't like.

[Wim Van den Wyngaert]

Simon,

There are 3 thresholds.

Security auditing server characteristics:
Database version: 4.4
Backlog (total): 100, 200, 300
Backlog (process): 5, 2
-> when audit_server has 100 unwritten messages, it will suspend processes
having 5 messages, at 200 those having 2 messages at 300 all processes.

I guess your "300" is reached and all process get suspended that have a message. Don't understand however why a simple telnet (probably without message) is suspended.

Wim

[Brown, Simon]

Thanks - anyway I've added my listener to the exclude list.

[Wim Van den Wyngaert]

Unless your disk is running full because of the growth of the audit log file. In that case, ALL processes that are not excluded will get suspended.

Wim

[Wim Van den Wyngaert]

Thank you too. I also added my program to the exclude list (thought it was done but it wasn't). We had the case several times that lots of production processes were suspended by audit. But I lost track of the details because it was before we used outlook.

Don't forget to exclude system monitoring too, if any.

Wim

[Wim Van den Wyngaert]

If you do help audit/excl you'll get a list of processes that are excluded from suspending.

None of the TCP processes is on the list.

So, you're telnet might look suspended because tcpip$inetacp gets suspended.

Wim

[Robert Gezelter]

Simon,

I have seen behavior similar to your description. The behavior that I have seen will not be completely cured without two forms of protective measures beyond changing the thresholds to higher values.

The intrinsic nature of the mailbox pardigm (as opposed to the "IO driver connection" paradigm) is that there is no generally used automatic mechanism for disconnection. And indeed, if your program just stops pulling messages from the mailbox, then the mailbox will fill, regardless of the quota. It is just a matter of time.

Most importantly, you need a mechanism to disable the audit server listener mailbox if your process aborts. Infinite loops are a different matter, quotas can be helpful, but the solution is a more complex issue, without a good general solution. It is difficult, and highly program specific to truly distinguish a infinite loop from a busy program (I would have to review the code to come up with some ideas on that issue).

I hope that the above is helpful.

- Bob Gezelter, http://www.rlgsc.com

[Brown, Simon]

Now I run at a priority of 8, don't loop (I know that) and have my own process added via /exclude.

I have a big mailbox and an exit handler.

Seems OK now - I am archiving circa 1,000 messages a second on my Windows server.