Troubleshooting Audit Logs
Novell Cool Solutions: Tip
By Craig Johnson
Digg This -
Posted: 14 Mar 2007
A Forum reader recently asked:
"From NWADMIN I am trying to View Audit Log. When I click Display Records I get a message that the operation cannot be completed (server returns code 0X24010c).
I have typed CSAUDIT on the console (not LOAD CSAUDIT). I see the message 'LOADING MODULE CSAUDIT ..." but I don't any new modules on my system. Where would I look to work with this tool?"
And here's the response from BorderManager expert Craig Johnson ...
It sounds like auditing itself is failing. CSAUDIT as a command should bring up a small menu where you can view audit log contents.
Have a look in the sys:system\cslib directories. When auditing is working normally, you should have some files in there. (These logs are not directly readable.) My servers have a csaudit.log and cssysmsg.log file, for instance, and a LOGS directory.
In the LOGS directory there, I have a SMLOGS directory with some (4) small .TMP files (0-1 kb each). I also have a ATLOGS directory with 7 .ARC files. These are the daily logs which by default roll over at 3 a.m. I've seen some of these get extremely large and cause issues if too much logging is enabled. (I don't enable any indexed logging, and I avoid using Access Rule logging on Allow rules.) If you see 1GB files in there, you may have log files that are too big in some circumstances.
The whole logging system there is btrieve-related. (Common and extended logs are NOT the same.) If you have an issue with logging, look into btrieve issues as a start. Also related here are the pxyhosts.nlm, cssysmsg.nlm, and csaudit.nlm modules - they should all be loaded.
Also, have a look at tip #38 at this URL:
Novell Cool Solutions (corporate web communities) are produced by WebWise Solutions. www.webwiseone.com