AUDIT SECURITY FILE --- BIG...

[IFX_1]

Hi All,
I open a new AUDIT SECURITY file using SET AUDIT/SERVER=NEW_LOG for clusterwide log file but the new created file allocated around 214K blocks. Do you have any idea why it was too big?

Directory SYS$COMMON:[SYSMGR]

SECURITY.AUDIT$JOURNAL;12 9/214056

[David Jones_21]

They assume you are creating new files periodically and preallocate a size they guess will eventually be needed by the new file based on the size of the existing file.

According to the help file, preceding your file create with SET AUDIT /JOURNAL=SECURITY
/THRESHOLD=WARN=200 to make a smaller file be created.

[David B Sneddon]

Ronald,

I believe the size of the new file is based on
the size of the old file. I know I have managed
to get it to create a much smaller file but at
the moment don't recall exactly what I did.
Have you tried stopping the server, renaming the
file then restarting it?
I think the size is held in a lock block somewhere.

Dave

[IFX_1]

Hi David J,
SET AUDIT/JOURNAL=SECURITY/THRESHOLD=WARN=200
It works. You just need to reissue again the SET AUDIT/SERVER=NEW_LOG

Thanks.

[IFX_1]

Thanks.

[John Gillings]

Ronald,

Consider that OpenVMS is doing you a service by preallocating the file to a reasonable prediction of the size it will grow to based on history. 200K blocks is all of 100MB. Worth what? Maybe 10c?

Unless you expect to change your rollover schedule for the audit journal, I'd strongly recommend you accept the preallocated size and avoid the work by the file system to extending the journal and fragmenting the disk.

If you really have to worry about 100MB of disk space, there's a serious misalignment of cost priorities on your site. Work out how many seconds of your time the capital cost of that disk space is worth. If you have to spend more than that time worrying about it, it would be far more cost effective to go out and buy more disk space.