Article 145784 of comp.os.vms:
|I've got a SYS$COMMON:[SYSMGR]SECURITY.AUDIT$JOURNAL;1
|which is over 100000 blocks in size.  Is there anyway
|to trim this file?
|
|Keith Wolters
|Senior System and Network Manager
|Wellesley College

Here is the guts of our routine which purges it once per period and keeps
the old file for one period.

================================================================================
$! Need to do the following so new log is small, otherwise new log will
$! be the size of the old log
$
$ set audit/journal=security/thresh=warn=200 
$
$ set audit/server=exit
$
$ wait 00:00:05
$
$ rename sys$manager:security.audit$journal -
         sys$sysdevice:[vms$common.sysmgr]security_old.audit$journal
$
$ if (f$search("sys$manager:security_old.audit$journal;-1").nes."")
$    then
$       purge sys$manager:security_old.audit$journal
$    endif
$
$ set audit/server=start
$
$ wait 00:00:05
$
$ set audit/server=init
$
$ wait 00:00:05
$
$! THIS NEXT PROCEDURE IS SPECIFIC TO OUR SITE
$
$ @com$manager:start_audit_server
================================================================================
com$manager:start_audit_server
================================================================================
$ set noon
$
$ write sys$output ""
$ write sys$output "Setting AUDIT_SERVER characteristics"
$ write sys$output ""
$
$ set audit/alarm-
           /enable= (-
                    breakin=all-
                    )-
           /disable=(-
                    acl,-
                    authorization,-
                    file_access:all,-
                    install,-
                    login:all,-
                    logout:all,-
                    logfailure:all,-
                    mount-
                    )-
           /failuser_mode=ignore
$
$ ! Log all login failures.
$ ! Send alarm messages to OPCOM.
$ ! Do not place all processes in MWAIT or crash system if OPCOM mailbox
$ ! is busy.  Instead increment counter that can be seen with SHOW AUDIT.
$
$ set audit/journal/resource=disable
$
$ ! Disable resource monitoring.  This will monitor diskspace on the disk
$ ! containing the audit server log file and take "action" if the disk runs
$ ! out of space.  Actions can include crashing the system, suspending all
$ ! all processes, or overwriting old entries.
$
$ set audit/server=final_action=ignore_new
$
$ ! If the disk on which the audit server log runs out of space, ignore new
$ ! alarms instead of crashing system or purging old entries
$
$ wait 00:00:05 ! wait to allow REPLYs to finish
$
$ exit
================================================================================

================================================================================
===  Norm Donovan                               Phone: (408)970-5678         ===
===  Siliconix/TEMIC Inc                                                     ===
===  Norm.Donovan@TEMIC.Com                                                  ===
================================================================================




