AF:
NF:0
PS:10
SRH:1
SFN:
DSR:
MID:<20080627223521.5cc1f16d@ripper.onstor.net>
CFG:
PT:0
S:andy.sharp@onstor.com
RQ:
SSV:onstor-exch02.onstor.net
NSV:
SSH:
R:<bmortensen@css.glasshouse.com>
MAID:1
X-Sylpheed-Privacy-System:
X-Sylpheed-Sign:0
SCF:#mh/Mailbox/sent
RMID:#imap/andys@onstor.net@onstor-exch02.onstor.net/INBOX	0	030a01c8d8d1$26664460$664f7e0a@cssltbmortensen
X-Sylpheed-End-Special-Headers: 1
Date: Fri, 27 Jun 2008 22:35:55 -0700
From: Andrew Sharp <andy.sharp@onstor.com>
To: "Bob Mortensen" <bmortensen@css.glasshouse.com>
Subject: Re: Clarification needed on Audit Log
Message-ID: <20080627223555.4cd97560@ripper.onstor.net>
In-Reply-To: <030a01c8d8d1$26664460$664f7e0a@cssltbmortensen>
References: <04af01c8d593$f9a1f9f0$6900a8c0@cssltbmortensen>
	<BB375AF679D4A34E9CA8DFA650E2B04E0A8FB5D4@onstor-exch02.onstor.net>
	<030a01c8d8d1$26664460$664f7e0a@cssltbmortensen>
Organization: Onstor
X-Mailer: Sylpheed-Claws 2.6.0 (GTK+ 2.8.20; x86_64-pc-linux-gnu)
Mime-Version: 1.0
Content-Type: text/plain; charset=US-ASCII
Content-Transfer-Encoding: 7bit

I don't believe this is correct at all, but I don't have time to check
the code at the moment.  Audit log data does not get written to /tmp
as it is generated, it is only there for a brief moment as I said
before.

On Fri, 27 Jun 2008 20:43:37 -0700 "Bob Mortensen"
<bmortensen@css.glasshouse.com> wrote:

> Dennis:
> 
>  
> 
> I think I have arrived at the truth (or something close to it). From
> the information I received from multiple sources (especially Shin
> Irie and May Ma), I have pieced together a response to the customer.
> This isn't exactly a correction of your documentation and you will
> need to reword it, but maybe it will be useful:
> 
>  
> 
> If anyone spots any errors in this, please let me know so I can
> update the customer.
> 
>  
> 
> "The text in the System Administrator's Guide is incorrect; if the
> file size is set to 0 then the circular file setting is ignored. So
> regardless of the circular file setting, if you set the file size to
> 0 the file will continue to grow without wrapping back over the
> earlier entries. The circular file setting should only be enabled if
> you wish to keep a small size file, but I know this is not your
> intention.
> 
>  
> 
> The audit file is initially stored in the /tmp directory on the FLASH
> card, which has about 19 MB available. In order to continue adding
> entries to the file, the data must be exported to a storage volume.
> You can export the data manually using the command audit export, but
> I think it would be better for you to set it to occur automatically.
> You can specify a time interval using the options options [-m MINUTE]
> [-h HOUR] [-d DATE] [-M MONTH] [-D DAY].
> 
>  
> 
> You must determine the best interval for your situation. If you set
> the interval too long then the FLASH might become full and then new
> entries would not be added. It is recommended that you do not allow
> the file to exceed 15 MB, because some other daemons may use /tmp as
> well. 
> 
>  
> 
> When the data is exported to a storage volume, the file can grow to a
> much larger size. Typically there would be some user data on the
> storage volume, so the file size limit is equal to the size of the
> volume minus size of the user data. But if the AutoGrow feature is
> enabled, then the volume can be increased in size automatically in
> case the file reaches this limit."
> 
>  
> 
>  
> 
> Best regards,
> 
> Bob Mortensen
> 
>  
> 
>  
> 
>   _____  
> 
> From: Dennis Arellano [mailto:dennis.arellano@onstor.com] 
> Sent: Monday, June 23, 2008 6:40 PM
> To: Bob Mortensen (Glasshouse); dl-cstech
> Subject: RE: Clarification needed on Audit Log 
> 
>  
> 
> When an answer is given, I would appreciate someone filing a
> documentation defect against the SAG to correct any ambiguous wording.
> 
>  
> 
> Thanks, Dennis
> 
>  
> 
>   _____  
> 
> From: Bob Mortensen (Glasshouse) 
> Sent: Monday, June 23, 2008 5:48 PM
> To: dl-cstech
> Subject: Clarification needed on Audit Log 
> 
>  
> 
> Hi:
> 
>  
> 
> Some questions have been raised by SGI Japan (Koichi Inaoka) about
> the Audit function. I have tried to answer his questions by
> referencing the System Administrator's Guide (SAG) but some of the
> text there is unclear and he keeps coming up with more questions.
> 
>  
> 
> The full conversation can be found in the case notes of case 8472,
> but I will summarize below. There are also some files in the Data
> Warehouse.
> 
>  
> 
> The initial complaint was that new records in the audit log were
> overwriting older ones. They had deliberately set the Maximum File
> Size to a large number (1024000000) to avoid this, but they were
> still overwriting older records. I quoted them some text from the SAG
> (see below) and recommended that they change the Maximum File Size to
> 0. This seems to be working better for them, but they are questioning
> some of the wording.
> 
>  
> 
> The following is an excerpt from the SAG:
> 
>  
> 
> The default size of the file is 0 for unlimited space. The file
> behaves differently depending on whether the file is configured as a
> circular file:
> 
> *	If the file size is 0 and the file is circular, the file
> will not wrap.
> *	If the file size is 0 and the file is not circular, it will
> continue to grow until it reaches the maximum disk space minus the
> amount of user data. At this point, the file will no longer accept
> new audit log entries. However, if you have configured AutoGrow on
> the volume, prior to the file reaching the truncation point, the NAS
> Gateway can automatically add more disk space.
> 
>  
> 
> The confusing part seems to be "If the file size is 0 and the file is
> circular, the file will not wrap." 
> 
>  
> 
> If it doesn't wrap, what happens when the volume is full? 
> 
> *	If it stops accepting new entries, how is this different
> from the case when circular is not enabled? 
> *	If it doesn't stop accepting new entries, where can it put
> them except to overwrite old entries, which is wrapping?
> 
>  
> 
> The text says that if the file is not circular and you reach the disk
> space limit, AutoGrow can automatically add more disk space. Does
> AutoGrow also apply when the file is circular?
> 
>  
> 
> Additionally, there is a question about the size they had originally
> set. In the SGA it is shown as 1024000000 but it's not clear what
> this means. The SAG says that the value is entered at the CLI in KB,
> so is this number the same as what would be entered (1024000000 KB),
> or does it mean 1024000000 bytes?
> 
>  
> 
> Best regards,
> 
> Bob Mortensen
> 
>  
> 
>  
> 
