In Privileged Account Manager, the usrun sessions are terminated with an auditing error when the server ran out of disk space. For long term running processes, this is not the ideal solution. You can use Command Control scripts to slow down or freeze input/output for the following conditions:
In usrun sessions when disk space is low.
When the store and forward process cannot contact an audit manager and its queue size is increasing.
You can control what happens under these conditions by configuring the following attributes:
disk_min_free (default: 1MB): Minimum free disk space. When free disk space goes below this level, the action defined in backoff_action is applied.
If the backoff_action is block, the audit message is paused until disk space becomes available.
If the backoff_action is fail, the request to store the audit message fails with an error, and the user session is terminated.
If the backoff_action is allow, the session is unaffected.
disk_wm_free (default: 2MB): Free disk space watermark. When the free disk space goes below this level, the delay defined in backoff_delay is applied between each audited message.
queue_max_size (default: 250MB): Maximum queue size. When the queue size goes above this level, the action defined in backoff_action is applied.
If the backoff_action is block, the audit message is paused until the queue size reduces below this level.
If backoff_action is fail, the request to store the audit message fails with an error, and the user session is terminated.
If backoff_action is allow, the session is unaffected.
queue_wm_size (default: 100MB): Queue size watermark. When the queue size goes above this level, the delay defined in backoff_delay is applied between each audited message.
backoff_divisor (default: 1): Provides the ability to increase the delay as the disk space reduces or the queue size increases. The delay is calculated by dividing the range between the disk_wm_free and disk_min_free (or queue_max_size and queue_wm_size) by the backoff_divisor and then applying the delay for each increment.
backoff_delay (default: 500ms): Time in milliseconds to delay the audit request.
backoff_action (default: block): Either block, fail, or allow.
The following Command Control script illustrates how to change these settings:
my $t=$meta->child("Audit");
$t=$meta->add_node("Audit") if(! $t);
$t->arg("disk_min_free","10");
$t->arg("disk_wm_free","20");
return 1;
This script sets the disk_min_free attribute to 10MB and the disk_wm_free attribute to 20 MB. You can assign this script to any rule or you can assign it to a rule at the top of the tree that all commands pass through.
You should create an emergency policy that allows administrators to access the machine when disk space is low or the store-and-forward queue size is large. Such a script would look similar to the following:
my $t=$meta->child("Audit");
$t=$meta->add_node("Audit") if(! $t);
$t->arg("disk_min_free","0");
$t->arg("disk_wm_free","0");
$t->arg("queue_max_size","0");
$t->arg("queue_wm_size","0");
$t->arg("backoff_action","allow");
return 1;
You can assign this script to any rule or you can assign it to a rule at the top of the tree that all commands pass through