Full filesystem from auditing and database stuck

[J. Kamentz]

Hi guys,

due to our security requirements we enabled auditing for our HPUX systems. From the audsys command I verified that the logfiles go to a separate filesystem (/dev/vg00/lvol11).

On the last weekend this filesystem went to 100% due to a huge increase of the logfile.

I would not expect any negative effect for the OS or the application, but the oracle guys told me that the database got stuck and only after increasing the auditing filesystem everything worked well again.

From the posts out here I found no similar experiences.

Is anybody aware of problems like that, when the auditing filesystem gets filled??

Find attached some more information.

Thanks in advance
Johannes

[RAC_1]

By any chance does oracle sit/write to same disk where lvol11 is?? then it might create problems for oracle.

you must look at acct_suspend and acct_resume parameters to suspand and resume accounting when these values are hit. With this you will not run into this problem.

Anil

[Rick Garland]

Could it be that the archive logs for Oracle are located in the VG/LV?

If the Oracle is not able to write archive logs then the database will "get stuck". After creating more room for archives the database will start functioning again. Typically no intervention is required on the Oracle side. Once there is room for the archives it will start functioning again.

[J. Kamentz]

Thanks for Your answers and as a reply to your comments:

In the mentioned filesystem ( /mnt/audit ) no other files are located beside files from the auditing subsystem. There are no oracle related files in it.

The kernel values are

acctresume = 4
acctsuspend = 2

which I think is the default. As far as I understand, these parameters only would help to avoid the filesystem filling.

Any other idea if auditing could lead to paused / hanging DB processes ?

Appreciate Your answers.
Johannes

[RAC_1]

Does lvols - that oracle uses and auditing log lvol uses on same pv, vg?? If yes, if pv/vg gets full, you may run into problem.

Anil

[J. Kamentz]

As mentioned oracle and auditing are in completely separated filesystems.

But anyway it seems there is either no easy or no explanation for this behaviour.

Thanks again for your help.
Johannes