TMF Operations and Recovery Guide (G06.24+)

Occasional Operations
HP NonStop TMF Operations and Recovery Guide—522417-002
3-5
Responding to Audit-Trail Overflow
Responding to Audit-Trail Overflow
The overflow threshold is the capacity to which an audit trail can fill before TMF copies
the oldest audit-trail file to an overflow-audit volume. Audit trails with an overflow
threshold of 80% (default) or slightly higher should rarely exceed that threshold. Also,
because audit trails can span multiple active-audit volumes and be reconfigured at any
time, the possibility of exceeding the overflow threshold should be minimal. This
section discusses the most typical reasons for an audit trail to reach its overflow
threshold and suggests ways to respond to these situations.
Reason: Audit trail is too small
Meaning. The audit trail was configured too small to accommodate the audit
information your system generates, causing frequent overflow conditions.
Action. Enlarge the audit-trail size by increasing the number of files that reside on
each active-audit volume, or the number of active-audit volumes. For more
information, see The ALTER AUDITTRAIL Command on page 3-7.
Reason: Audit dump tapes not mounted
Meaning. If tapes are not mounted and ready when TMF attempts to start an audit
dump, the audit records that continue to accumulate eventually cause the audit trail to
fill.
Action. Anticipate the need for audit dumps by checking the audit-trail status displays
and make sure tapes are mounted in advance. See Section 4, Audit Dumps, for
information on maintaining audit dumps.
Reason: Audit dump disk media unavailable
Meaning. If disk media is down or disk space is unavailable when TMF attempts to
start an audit dump, the audit records that continue to accumulate eventually cause the
audit trail to fill.
Action. Anticipate the need for audit dumps by checking the audit-trail status displays
and make sure the disks used for audit dumping are maintained properly so that
dumps can be performed as needed. See the Guardian User’s Guide for information
on maintaining disk media on your system.
Reason: Audit dumping disabled
Meaning. If a DISABLE AUDITDUMP command is issued, no further audit dumps
occur. Audit records continue to accumulate and the audit trail fills.
Action. Issue an ENABLE AUDITDUMP command to resume audit dumping.