Safeguard Audit Service Manual (G06.24+, H06.03+)

Managing the Audit Trail
Safeguard Audit Service Manual—520480-014
3-8
Releasing Audit Files
You can also use SELECT CURRENT AUDIT POOL to close the current audit file and
switch to another audit pool. For example, this command closes the current audit file
and switches to the first available audit file in the audit pool at $SECURE.AUDIT3:
=SELECT CURRENT AUDIT POOL $secure.audit3
Releasing Audit Files
When you no longer need to retain a used audit file, you can purge it with the
RELEASE command. When you release an audit file, the Safeguard software purges
data from the file, renames the file, and marks it for reuse.
For example, suppose that you no longer need to keep audit files A0000008 and
A0000009. To release the files:
=RELEASE A8, A9
You do not need to include the leading zeros of the audit file name.
You can also specify a range of files in the RELEASE command. For example, this
command releases audit files A0000008 through A0000012:
=RELEASE A8 : A12
RELEASE can be executed only by members of the SYSTEM-OPERATOR security-
group.
Deleting Audit Files
You can delete audit files that are no longer needed. Deleting a file permanently
removes it, whereas releasing a file purges the data in the file and marks it for reuse
under a new name.
The process for deleting a file involves releasing the file and then reducing the number
of MAXFILES in the file's audit pool. This example illustrates this sequence of
commands.
This example assumes that six audit files named A0000023 through A0000028 are in
the audit pool at $SECURE.OP2. These commands delete four of the audit files:
=RELEASE A23 : A26 IN $secure.op2
=ALTER AUDIT POOL $secure.op2 MAXFILES 2
Deleting an Audit Pool
When you no longer need to retain an audit pool, you can delete it with the DELETE
AUDIT POOL command. When you delete an audit pool, you must first release all files
in the audit pool:
=RELEASE A1 : A7 IN $secure.audit2
=DELETE AUDIT POOL $secure.audit2
Caution. Purging audit files can cause system performance problems.