12.3.1 Moving audit trail files (to audit trail storage directory)

This subsection describes how to move audit trail files from the audit trail directory to the audit trail storage directory.

The HADB administrator must regularly move audit trail files from the audit trail directory to the audit trail storage directory. By moving these files regularly, you can prevent issues like the following:

The disk containing the audit trail directory becoming full

If 0 is specified for the adb_audit_log_max_num operand in the server definition, there is no limit to the number of audit trail files that can be created. If you do not move the audit trail files, the disk will eventually become full.
Old audit trail files being deleted

If 4 or greater is specified for the adb_audit_log_max_num operand in the server definition, a limit is imposed on the number of audit trail files that can be created. If the number of audit trail file exceeds the maximum, the oldest audit trail file is deleted. Therefore, older audit trail files will be deleted unless they are moved.

The timing with which to move audit trail files is as follows. Ensure that you move audit trail files before the disk containing the audit trail directory becomes full, and before old audit trail files are deleted.

■ Timing of moving audit trail files

Move audit trail files at predetermined times.

Move the audit trail files at times determined in advance. For example, you might move audit trail files once a day.
Move audit trail files when the files are swapped.

Move audit trail files immediately after the current audit trail file is swapped. Monitor the messages KFAA81401-I and KFAA81402-I output when the audit trail file is swapped.

Important

If 4 or greater is specified for the adb_audit_log_max_num operand in the server definition, older audit trail files might be deleted before the audit trail files can be moved at the predetermined timing. You must therefore monitor these messages and move the audit trail files as soon as the audit trail file is swapped.

Use the following procedure to move audit trail files:

■ Procedure for moving audit trail files

Copy the audit trail files from the audit trail directory to the audit trail storage directory.

Do not copy the current audit trail file.
When the copy process has completed, delete the audit trail files at the source.

Do not delete the following files:
- The current audit trail file
- Audit trail files being read by an ADB_AUDITREAD function
Important

If you delete the current audit trail file, any audit trail data that was output to the current audit trail file is lost. For this reason, take care not to delete the current audit trail file.

The following is an example of moving audit trail files.

■ Example of moving audit trail files

In this example, audit trail files are moved from the audit trail directory (/mnt/audittrail/outputarea/audit) to the audit trail storage directory (/mnt/audittrail/shorttimesavearea/audit_bak).

Create a list of audit trail files that need to be moved.

Using the find command of the OS, search for audit trail files in the audit trail directory and create a list of audit trail files (/home/adbmanager/tmp/auditfilelist.txt) that need to be moved. Note that the following command excludes the current audit trail file from its results.
```
find /mnt/audittrail/outputarea/audit \
    -name "adbaud-????????-??????-???*.aud" \
    > /home/adbmanager/tmp/auditfilelist.txt
```
Copy the audit trail files that need to be moved.

Use the cp command of the OS to copy all of the files in the list (/home/adbmanager/tmp/auditfilelist.txt) that need to be moved from the audit trail directory to the audit trail storage directory.
```
while read filename ; do
  cp ${filename} /mnt/audittrail/shorttimesavearea/audit_bak
done < /home/adbmanager/tmp/auditfilelist.txt
```
Delete the audit trail files for which the copy process has completed.

When the copy process has completed, use the rm command of the OS to delete the source files from the audit trail directory.
```
while read filename ; do
  rm ${filename}
done < /home/adbmanager/tmp/auditfilelist.txt
```
Delete the list of audit trail files that need to be moved.

Using the rm command of the OS, delete the list you created in step 1 (/home/adbmanager/tmp/auditfilelist.txt) of audit trail files that need to be moved.
```
rm /home/adbmanager/tmp/auditfilelist.txt
```

To Page Top