accountng.dat is corrupted

[Rupert_1]

Hi,
When I issued command
analyze accountng.dat/audit/since=16-dec-2003/summary, I got %AUDSRV-W-BADRECORD, invalid data in record 6331,.....
Is there a way to recify the record ?

[Martin P.J. Zinser]

Hello,

the first thing you want to do is redirect new events to a new log file. This can be done using

set audit/server=new_log

Once the old file is free

1.) Make another backup copy!
2.) Totally untested conjecture -
From looking at the audit log it seems it
contains one event per record.
So the following procedure might work

*anal/rms/fdl on the audit log ->security.fdl
*edit/tpu, delete line 6331
*convert/fdl=security.fdl edited_copy good_audit

Good luck,

Martin

[Lokesh_2]

Hi ,

The security audit file is SECURITY.AUDIT$JOURNAL . So, use this file in place of accountng.dat. To see information of ACCOUNTNG.DAT , use ACCOUNTING utility.

$ACCOUNTING/SINCE=16-DEC-2003/SUMM ACCOUNTNG.DAT

Thanks & regards,
Lokesh

[Terry Yeomans]

To free of the file (and create a new version), do the following:
SET ACCOUNTING /DISABLE
SET ACCOUNTING /ENABLE
SET ACCOUNTING /NEW_FILE
Then have a play with your old file, which will be called SYSTEM_DISK:[SYS0.SYSMGR]ACCOUNTNG.DAT
Terry.

[Pim van Velzen]

Given the analyze/audit-command you are issuing, it looks like you would like to get auditing-information (instead of Accounting-data, which the input-file contains).

To find out which input-file to specify, use the '$ SHOW AUDIT'-command and look at the destination-file.

$ sho audit/all
Journal name: SECURITY
Journal owner: (system audit journal)
Destination: DISK1:[DIRECTORY]SECURITY_AUDIT.LOG

$ anal/audit DISK1:[DIRECTORY]SECURITY_AUDIT.log

31-DEC-2003 00:00:01.95 LOGIN NETWORK NODE1 UCX$SNMP 228005DE
31-DEC-2003 00:00:04.25 LOGIN NETWORK NODE1 UCX$SNMP 228005DF
31-DEC-2003 00:00:05.56 LOGIN NETWORK NODE1 UCX$SNMP 228005E0
31-DEC-2003 00:00:07.73 LOGIN NETWORK NODE1 UCX$SNMP 22800602
31-DEC-2003 00:00:09.14 LOGIN NETWORK NODE1 UCX$SNMP 22800603
31-DEC-2003 00:00:10.47 LOGIN NETWORK NODE1 UCX$SNMP 22800604