SoftTree Technologies SoftTree Technologies
Technical Support Forums
RegisterSearchFAQMemberlistUsergroupsLog in
System Audit Trail Queue Size

 
Reply to topic    SoftTree Technologies Forum Index » DB Audit, DB Mail, DB Tools View previous topic
View next topic
System Audit Trail Queue Size
Author Message
jr0214



Joined: 22 Jul 2014
Posts: 2
Country: United States

Post System Audit Trail Queue Size Reply with quote
We are receiving the following warning message on a high traffic database server with system audit enabled to log successful logins:

"Audit writer process does not keep up with the volume of generated audit events. Some events might be missed. If you see recurring messages of this type, consider increasing audit queue size."

Based on that warning, my instinct was to increase the Audit queue size in config to something much larger than the default of 2MB; however when reading the DB Audit User Guide I am confused by the following sentences in the "Important Notes" section:

Important Notes: Small values lead to a greater database performance impact caused by the auditing. On the contrary large values reduce the impact but lead to a greater time lag between event occurrence and recording and ultimately may cause event misses

I am interpreting that as if I increase the size of the queue, I could possibly miss events; however the warning message contradicts the "important note" and is stating that the queue size should be increased because it's not able to capture all of the events. So should I actually increase the queue size? If so, how can I gauge what size to increase it to?
Tue Jul 22, 2014 5:05 pm View user's profile Send private message
SysOp
Site Admin


Joined: 26 Nov 2006
Posts: 7833

Post Reply with quote
I believe it's saying that the bigger the queue, the longer it may take the system to flush it to the disk (audit trail table)

As for the high volume issue and the system not being able to save events as fast as the occur, I suggest checking already saved events and figuring out what's causing such high volume, then setting appropriate audit filters to ignore unimportant noise (events, users, or applications you don't care about)
Tue Jul 22, 2014 6:20 pm View user's profile Send private message
jr0214



Joined: 22 Jul 2014
Posts: 2
Country: United States

Post Reply with quote
Thanks for the clarification.

I was able to determine that one of our applications using that database server is logging an insane amount of successful logins each time a user logs in. For now I've filter that application out.
Wed Jul 23, 2014 4:57 pm View user's profile Send private message
Display posts from previous:    
Reply to topic    SoftTree Technologies Forum Index » DB Audit, DB Mail, DB Tools All times are GMT - 4 Hours
Page 1 of 1

 
Jump to: 
You cannot post new topics in this forum
You cannot reply to topics in this forum
You cannot edit your posts in this forum
You cannot delete your posts in this forum
You cannot vote in polls in this forum


 

 

Powered by phpBB © 2001, 2005 phpBB Group
Design by Freestyle XL / Flowers Online.