Safeguard Audit Service Manual (G06.24+, H06.03+)

Managing the Audit Trail
Safeguard Audit Service Manual—520480-014
3-5
Selecting an Audit Pool
You can also create an audit pool that has the same parameters as an existing audit
pool. For example, use this command to create an audit pool at $KEEPER.AUDIT1
using the same parameters as the existing audit pool at $SECURE.AUDIT2:
=ADD AUDIT POOL $keeper.audit1 LIKE $secure.audit2
As this example shows, you can choose to create audit pools on different disk volumes
so that auditing can still occur if the current disk volume becomes inaccessible.
Selecting an Audit Pool
If you have created multiple audit pools, you must use the SELECT command to
designate the current audit pool and thereby direct the audit service to begin writing
audit records to it. The Safeguard subsystem uses the audit pool at $SYSTEM.SAFE
until you define and select another audit pool.
For example, use this command to select the audit pool on $SECURE.AUDIT2 and to
begin writing audit records to the first file in that audit pool:
=SELECT CURRENT AUDIT POOL $secure.audit2
If you have defined multiple audit pools, you can also designate the next audit pool to
be used in the event that the current audit pool becomes filled or inaccessible. Use this
form of the SELECT command to specify the next audit pool:
=SELECT NEXT AUDIT POOL $keeper.audit1
Specifying Audit Service Recovery
If you have used the SELECT command to designate the next audit pool, the
Safeguard software automatically switches to that audit pool if the current audit pool
becomes full or inaccessible. You can use the ALTER AUDIT SERVICE command to
specify the recovery action to be taken if the next audit pool is not defined or is not
accessible.
ALTER AUDIT SERVICE allows you to specify recovery for two distinct types of
situations—disk file overflow and a down volume. If you do not specify recovery actions
for these situations and no next audit pool is selected, the Safeguard software attempts
to recycle the audit files in the current audit pool. If it cannot recycle the files, the
Safeguard software automatically suspends auditing.
Overflow means the current audit file is full and no additional unreleased audit files are
available in the current audit pool. Down volume means the disk volume containing the
current audit pool has become inaccessible.
Caution. Creating a Safeguard audit pool on an HP NonStop Transaction Management Facility
(TMF) active audit volume can result in system performance problems during periods of heavy
disk process activity.