06-28-2007 6:27 AM
Hi everyone,
I can't activate/deactivate Security Audit via SM19.
I tried to activate the security audit but the program has aborted. The Current File Size is 977kb vs Maximum File Size of 976kb. I run SM18 to initialize the log but the activation has aborted once again. The File Size remains at 977kb.
Thanks,
Kiko
06-28-2007 9:11 AM
Hi,
Please check the following profile parameters...
DIR_AUDIT
Directory for security audit files
FN_AUDIT
Name of security audit file
rsau/enable
Enable Security Audit
rsau/max_diskspace/local
Maximum space for security audit file
rsau/max_diskspace/per_day
Maximum size of all security audit files
rsau/max_diskspace/per_file
Maximum size of one single security audi
rsau/selection_slots
Number of selection slots for security a
rsau/user_selection
Defines the user selection method used
Regards
Ben
06-28-2007 10:42 AM
Hi Enrico,
It sounds like your diskspace per day is full. In this case the log stops, keeping the records; but rejecting new ones (LIFO principle).
That SM18 will not let you then delete the full daily log, sounds like an intentional security feature to me (not sure though).
Cheers,
Julius
06-28-2007 12:17 PM
Hi Julius,
Thru SM18 it has allowed me to delete the log files but when you look at the SM19 the file size remains at 977kb. What could be the problem here?
Thanks,
Kiko
06-28-2007 12:59 PM
Hi Enrico,
Can you also still read from files (from SM20)? That would indicate that they are not realy deleted (in SM18) - actually I think I remember having read something about not deleting a file from the same day?
Another possibility is that you have more than 1 app servers? E.g. one for SM18, one for SM19 dynamic settings and one for SM20...
Julius
06-29-2007 5:35 AM
Hi Julius,
No. When you run SM20 it doesn't read the log file anymore.
Yes. We have 4 app servers. But from what I understand you do the settings in any server then it will distribute the settings to other app servers.
Until now the File Size is still at 977kb. I can't remove it.
Thanks,
Kiko
06-29-2007 8:59 AM
Hi Kiko,
It may be a problem in the SM19 screen program (bug?), which is not picking up the fact that the file size has changed to 0. This sort of thing has tricked me before...
The easiest solution would be to increasing the file size, then you dont need to delete it to get new records? Read up on the file_per_day parameter (mentioned above) documentation in RZ11 or report RSPFPAR.
regards,
Julius
07-25-2007 1:58 PM
All,
I believe you can only delete files odler than 3 days. Build-in security so you don't delete recent logfiles...
07-18-2008 11:44 AM
hey this is hajee
i am trying to configuring security audit through the transcation sm19 can any one tell me how much dist space we have to give means maximum sapce of audit file and maximum files per day can you tell the values what i have to maintain over there please help on this issue
thanx in advance
hajee