Handling Corrupted Logs in Audit
Novell Cool Solutions: Tip
By Jason Doering
Digg This -
Posted: 7 Jun 2006
A Forum reader asked the following question:
"We are having problems with the Log DB becoming corrupted. I have tried shutting lengine.nlm so nothing is writing to mysql. This works sometimes, but not always. Is there a better way to shut down the auditing server before rebooting the system?"
And here's the response from Audit expert Jason Doering ...
Simply typing "unload lengine" is the only way to shut down the Novell Audit SLS. You can attempt to repair the table with this process:
Shut down the SLS:
Shut down MySQL:
1. mysqladmin -u root -p shutdown (Enter the root MySQL user's password)
2. Repair the table (enter your full path to the data tables):
myisamchk -rq vol1:\mysql\data\naudit\log
3. Restart MySQL:
4. Restart Novell Audit:
If you have the caching configured correctly and leave the platform agent running, it minimizes the data you lose. The only events that could be lost are those that the SLS has not written to the database.