Resizing of the Security.Audit$journal file

[Peter H. Mudd]

Need to move Security.audit$journal to another drive and also resize the audit file.

[Steven Schweda]

Resize? You can use a command like
ANAL /AUDI /BINA /SINC = sometime -
/OUTP = somewhere
to strip out old data.

HELP SET AUDI /DEST may tell you more about
specifying the location of the file.

This also mentions SET AUDIT /SERVER=NEW_LOG,
which effectively resizes the (new) file (to
zero, because it's new).

Depending on what you really wish to do, you
may want to disable the audit server
(briefly) while you're fooling around with
its log file.

[Steven Schweda]

> [...] to another drive [...]

See also SYS$MANAGER:SYSECURITY.COM.

[Jim_McKinney]

Regarding the initial size of the audit journal file, see

$ HELP SET AUDIT/SERVER

and observe what it says about the NEW_LOG keyword as the new size is dependent upon the old size (in an effort to be efficient).

NEW_LOG Creates a new clusterwide audit log file.
Typically, this is used daily to generate a
new version of the audit log file.

The following sequence of commands can be used
to reset the space monitoring thresholds and
then to recreate the auditing log, thereby
creating a smaller log file:

$ SET AUDIT /JOURNAL=SECURITY
/THRESHOLD=WARN=200
$ SET AUDIT /SERVER=NEW_LOG

By default, the size of the new auditing log
file is based on the size of the previous
auditing logs.

For help with the designating a non-default location for the file see

$ HELP SET AUDIT/JOURNAL

[jpd252]

to move to another devicewould need to do the following..

     ed SYS$COMMON:[SYSMGR]sylogicals.com.com and add the following: 

DEFINE/SYSTEM/EXECUTIVE SYS$AUDIT_SERVER_INHIBIT YES

     ed SYS$COMMON:[SYSMGR]sysecurity.com and add the following

Mount/System/Rebuild/Noassist RXTB1I$DKA1: AUDITDSK AUDITDSK 

then type the following: 

SET AUDIT/JOURNAL/DESTINATION= DKA1:[AUDIT]

SET AUDIT/SERVER=NEW_LOG