Safeguard Audit Service Manual (G06.29+, H06.08+, J06.03+)

Managing the Audit Trail

Safeguard Audit Service Manual — 520480-031

3 - 10

Deleting an Audit Pool

When you no longer need to retain an audit pool, you can delete it with the DELETE

AUDIT POOL command. When you delete an audit pool, you must first release all files

in the audit pool:

=RELEASE A1 : A7 IN $secure.audit2

=DELETE AUDIT POOL $secure.audit2

You cannot delete the current audit pool.

Audit Pool Precautions During a Cold Start

If the Safeguard subsystem was included with system generation, take these

precautions to prevent auditing from being suspended during a cold start of the

system:

1. Before shutting down the system, check that the current audit pool resides on a

disk that is connected to the same processor as the $SYSTEM disk.

2. When the cold start is complete, you can select a new audit pool on another disk

volume if necessary.

Note. Check that the current audit pool resides on the $SYSTEM disk when Safeguard is

configured as a persistent process and STARTMODE is KERNEL. If the current audit pool

resides on a non-$SYSTEM disk and STARTMODE is KERNEL, the audit state can

become suspended and require manual intervention (SAFECOM NEXTFILE) to resume

full auditing. If the current audit pool resides on a non-$SYSTEM disk, the recommended

value for STARTMODE is SYSTEM.