Auditing Becomes Disabled Following a Backup

[Lee_Morgan]

Using XIR2 SP4, when a backup runs overnight this sometimes has the effect of disabling auditing on some servers. Auditing is, by default, comprehensively enabled across all servers but we've been checking this over several days and have seen many instances where the auditing was disabled when the servers are re-started after the backup runs and must be manually re-enabled through the CMC.

Has anyone else had a similar experience or could you suggest why this may be happening or how it might be prevented?

I'd also like a quick way of identifying this when it happens - e.g. through a report with alerters to show when the server auditing is disabled (if possible). Does anyone know where the server auditing information is held?

[Former Member]

Hello Lee,

How is your backup organized? Do you first shut down all services and the commence a database backup?

What happens when you manually shut down the services? Are the auditing settings saved after restarting the services?

I'm afraid you won't be able to access the audit settings directly, as the XI metadata is stored binary, and thus not accessible as was the case in legacy versions. The only way to access it is through the SDK (or the query builder, which uses the SDK in the background).

Kind regards,

Kristof

[Lee_Morgan]

Kristof,

Thanks for your very helpful answer. No, not all services are stopped before the backup runs, only the CMS, Input FRS, Output FRS and Event Server are being stopped. These services are running on a separate management layer and the system database and FRS filestore backups are synchronised.

Manually shutting down the services and restarting them did originally cause the auditing settings to be lost but once these were reapplied this hasn't consistently been the case since.

The explanation appears to be that Business Objects servers are running as an active directory domain user, this user until approximately two weeks ago did not have full admin rights. The Business Objects servers are installed and configured as an administrative user and then configured to user the Business Objects service user credentials. Prior to the promotion of the user credentials to admin any attempt by the server to update the audit registry keys would have failed even though the CMC screen shows the options as selected. Any subsequent restart of the server (nightly for the CMC etc. but very infrequent for any processing servers) would have failed to find the required registry keys and started up with auditing disabled. Now the Business Objects service user has administrative privileges (this promotion is as a result of the backup work) registry permissions are not an issue and the keys can now be written.

We need to continue checking the settings over the next few weeks to be sure we are happy with the configuration and this explanation.

Fond regards,

Lee

Edited by: Lee Morgan on Oct 8, 2008 5:51 PM