The default configuration does not encrypt or roll over the audit databases. If your security model requires you to keep audit records available for years, you need to configure the rollover options and move the rolled-over files to an archive location.
Click Reports > Settings > Audit Settings on the home page of the Privileged Account Manager console.
In Audit Log Settings page, for each audit database file, set the rollover parameters. Rolled-over databases are kept as SQLite databases.
Audit DB Name: This column lists the configured audit database names. Except for Change Management chngmgnt database name which is present by default, all other database names are populated only when you configure them.
Rollover Time (hours): Specify the time interval for rolling over the audit file. If the time interval is always reached before the maximum size is reached, the time interval is used for rollover and the size restriction is ignored.
Rollover Size (MB): Specify the maximum size the file can reach before the audit file is rolled over. If the file always reaches the maximum size before the time interval is reached, the size restriction is used for rollover, and the time interval is ignored.
Protection: Select None to allow the rollover file to be an unencrypted file or select Encrypted to encrypt the audit database.
When you select Encrypted to encrypt any database, ensure that the NULL Cipher (clear text) key is disabled at Reports > Settings > Encryption Settings.
Encrypting the file can impact the performance of your audit managers. Also, the encrypted file can be decrypted by the Privileged Account Manager, but it cannot be displayed on new systems that do not detect the encryption keys.
To configure the encryption keys, click Reports > Settings > Encryption settings.
If you want to zip the rollover files or move them to another location, use the Rollover Script option to specify a Perl script that can perform these tasks. The script is called whenever an audit database is rolled over.
For example, the following script uses gzip to compress the rolled-over file and enters an error message in the unifid.log file.
if ($DBGRP eq 'cmdctrl') {
system("gzip $AUDIT_FILE");
$ctx->log_error("Audit rollover $DBGRP $AUDIT_FILE");
} Click Finish.