Operating System - OpenVMS
cancel
Showing results for 
Search instead for 
Did you mean: 

Audit Server - System Hangs

SOLVED
Go to solution
Brown, Simon
Occasional Advisor

Audit Server - System Hangs

I am going slowly crazy and it's only Monday.

I have a program listening to the audit server via the set audit/listener option.

If the program hangs or loops or whatever then my AXP VMS 6.2 system hangs up (not a crash - a hang). All my terminal windows hang (2 or 3 sessions with PUTTY). I am hammering the system, generating thousands of log entries in just a few seconds to test the software I wrote.

Now I thought there was a DCL option I could use. I have the server's final-action set to purge_old. I just do not want my customer's systems to hang.

So help me! simon.brown@kns.ch :-)
13 REPLIES
Wim Van den Wyngaert
Honored Contributor
Solution

Re: Audit Server - System Hangs

1) make sure that your program that reads the mailbox will not get suspended (set aud/excl).

2) make sure quotas are high for audit_server (and the mailbox reader)

3) check set aud/backlog to do the config of when getting suspended

Wim
Wim
Brown, Simon
Occasional Advisor

Re: Audit Server - System Hangs

I agree with the excellent suggestions, but why does an idle terminal session logged in as System get suspended?

This is what I don't like.
Wim Van den Wyngaert
Honored Contributor

Re: Audit Server - System Hangs

Simon,

There are 3 thresholds.

Security auditing server characteristics:
Database version: 4.4
Backlog (total): 100, 200, 300
Backlog (process): 5, 2
-> when audit_server has 100 unwritten messages, it will suspend processes
having 5 messages, at 200 those having 2 messages at 300 all processes.

I guess your "300" is reached and all process get suspended that have a message. Don't understand however why a simple telnet (probably without message) is suspended.

Wim
Wim
Brown, Simon
Occasional Advisor

Re: Audit Server - System Hangs

Thanks - anyway I've added my listener to the exclude list.
Wim Van den Wyngaert
Honored Contributor

Re: Audit Server - System Hangs

Unless your disk is running full because of the growth of the audit log file. In that case, ALL processes that are not excluded will get suspended.

Wim
Wim
Wim Van den Wyngaert
Honored Contributor

Re: Audit Server - System Hangs

Thank you too. I also added my program to the exclude list (thought it was done but it wasn't). We had the case several times that lots of production processes were suspended by audit. But I lost track of the details because it was before we used outlook.

Don't forget to exclude system monitoring too, if any.

Wim
Wim
Wim Van den Wyngaert
Honored Contributor

Re: Audit Server - System Hangs

If you do help audit/excl you'll get a list of processes that are excluded from suspending.

None of the TCP processes is on the list.

So, you're telnet might look suspended because tcpip$inetacp gets suspended.

Wim
Wim
Robert Gezelter
Honored Contributor

Re: Audit Server - System Hangs

Simon,

I have seen behavior similar to your description. The behavior that I have seen will not be completely cured without two forms of protective measures beyond changing the thresholds to higher values.

The intrinsic nature of the mailbox pardigm (as opposed to the "IO driver connection" paradigm) is that there is no generally used automatic mechanism for disconnection. And indeed, if your program just stops pulling messages from the mailbox, then the mailbox will fill, regardless of the quota. It is just a matter of time.

Most importantly, you need a mechanism to disable the audit server listener mailbox if your process aborts. Infinite loops are a different matter, quotas can be helpful, but the solution is a more complex issue, without a good general solution. It is difficult, and highly program specific to truly distinguish a infinite loop from a busy program (I would have to review the code to come up with some ideas on that issue).

I hope that the above is helpful.

- Bob Gezelter, http://www.rlgsc.com
Brown, Simon
Occasional Advisor

Re: Audit Server - System Hangs

Now I run at a priority of 8, don't loop (I know that) and have my own process added via /exclude.

I have a big mailbox and an exit handler.

Seems OK now - I am archiving circa 1,000 messages a second on my Windows server.
Ian Miller.
Honored Contributor

Re: Audit Server - System Hangs

Your user mode exit hander won't get called if your process is stopped. You may wish to have a kernel mode exit handler which does the necessary to stop messages being sent to your mailbox.
____________________
Purely Personal Opinion
Brown, Simon
Occasional Advisor

Re: Audit Server - System Hangs

I have forgotten so much VMS stuff it's really untrue :-(

One kernel-mode coming up.
Brown, Simon
Occasional Advisor

Re: Audit Server - System Hangs

I have forgotten so much VMS stuff it's realy untrue :-(

One kernel-mode coming up.
Ian Miller.
Honored Contributor

Re: Audit Server - System Hangs

Simon, welcome to the VMS Forum.

There are people here that have been playing with VMS long enough that we are starting to get the hang of it and can answer most questions.
____________________
Purely Personal Opinion