TMF Supplement for Large Audit Files (G06.24+)

TMF Reference Manual
HP NonStop TMF Supplement for Large Audit-Trail Files—527391-001
5-15
ALTER AUDITTRAIL (Pages 3-51 through 3-60)
Security Restrictions
You can issue the ALTER AUDITTRAIL command only if you are a member of the
super user group.
TMF State Requirement
You can enter the ALTER AUDITTRAIL command at any time, whether or not TMF has
been started. However, after TMF is configured and started for the first time, you can
add or delete active-audit volumes or alter AUDITDUMP to OFF only while TMF is up
and running.
Usage Guidelines
Before any auxiliary audit trail can be dumped, you must configure the master audit
trail (MAT) for this purpose.
Attributes that you do not specify remain unchanged. So, if you omit an optional
parameter, one of the following actions takes place:
•
If one or more previous TMFCOM commands (such as ADD AUDITTRAIL or
ALTER AUDITTRAIL) specified the parameter, the value entered in the last of
these commands remains assigned.
•
If no previous TMFCOM command specified the parameter, the originally assigned
default remains assigned.
AUDITDUMP Option Considerations
If you set the AUDITDUMP attribute to ON after TMF has been running with
AUDITDUMP OFF, the first file dumped is the file to which audit information is being
written (the current file). For example, if audit information is being written to file
sequence number 12 when AUDITDUMP ON is specified, the first file to be dumped
will be sequence number 12.
Changing AUDITDUMP from ON to OFF may impact file recovery: after an undumped
audit-trail file is renamed or purged, file recovery cannot be performed through that file.
For example, if file sequence number 23 is not yet dumped when AUDITDUMP is set
to OFF, then, after file 23 is renamed or purged, file recovery cannot recover files
beyond audit-trail file number 22 (however, file recovery to a timestamp before the end
of file number 22 is still possible).
To set AUDITDUMP to OFF for the master audit trail, you must also set it to OFF for all
auxiliary audit trails in the configuration. To set AUDITDUMP to OFF for any audit trail,
you must also set RECOVERYMODE to ONLINE for all data volumes that use this
audit trail.
Note. For both online dumps and audit dumps, Expand links to remote disk volumes must
support 56 KB input/output.