Troubleshooting Audit Logs



By: phxazcraig

March 14, 2007 4:35 am

Reads: 234

Comments:0

Rating:0

Problem

A Forum reader recently asked:

“From NWADMIN I am trying to View Audit Log. When I click Display Records I get a message that the operation cannot be completed (server returns code 0X24010c).

I have typed CSAUDIT on the console (not LOAD CSAUDIT). I see the message ‘LOADING MODULE CSAUDIT …” but I don’t any new modules on my system. Where would I look to work with this tool?”

And here’s the response from BorderManager expert Craig Johnson …

Solution

It sounds like auditing itself is failing. CSAUDIT as a command should bring up a small menu where you can view audit log contents.

Have a look in the sys:system\cslib directories. When auditing is working normally, you should have some files in there. (These logs are not directly readable.) My servers have a csaudit.log and cssysmsg.log file, for instance, and a LOGS directory.

In the LOGS directory there, I have a SMLOGS directory with some (4) small .TMP files (0-1 kb each). I also have a ATLOGS directory with 7 .ARC files. These are the daily logs which by default roll over at 3 a.m. I’ve seen some of these get extremely large and cause issues if
too much logging is enabled. (I don’t enable any indexed logging, and I avoid using Access Rule logging on Allow rules.) If you see 1GB files in there, you may have log files that are too big in some circumstances.

The whole logging system there is btrieve-related. (Common and extended logs are NOT the same.) If you have an issue with logging, look into btrieve issues as a start. Also related here are the pxyhosts.nlm, cssysmsg.nlm, and csaudit.nlm modules – they should all
be loaded.

Also, have a look at tip #38 at this URL:
http://www.craigjconsulting.com

VN:F [1.9.22_1171]
Rating: 0.0/5 (0 votes cast)

Tags: ,
Categories: BorderManager, Technical Solutions

Disclaimer: As with everything else at NetIQ Cool Solutions, this content is definitely not supported by NetIQ, so Customer Support will not be able to help you if it has any adverse effect on your environment.  It just worked for at least one person, and perhaps it will be useful for you too.  Be sure to test in a non-production environment.

Comment