Audit log not outputting or rotating in Identity Suite Virtual Appliance.

Products

• CA Identity Manager
• CA Identity Governance
• CA Identity Portal
• CA Identity Suite

Issue/Introduction

In the Identity Suite Virtual Appliance (vApp) environment, the audit.log file located in /var/log/audit/ may stop generating new entries or fail to rotate according to the defined configuration.

This prevents effective security monitoring and can lead to disk space exhaustion if rotation logic fails.

Environment

Identity Suite Virtual Appliance 14.5

Cause

This issue typically occurs if the auditd service becomes unresponsive or if the underlying service fails to initialize correctly after a system reboot or configuration change. In some cases, a full /var partition can also prevent the service from writing or rotating log files.

Resolution

1. Log in to the Virtual Appliance (vApp) console.
2. Verify the status of the audit service.
3. Restart the auditd service using the following commands:
   • service auditd stop
   • service auditd start
4. Confirm that the audit.log file is now receiving updates by running:
   • tail -f /var/log/audit/audit.log
5. If the logs still do not rotate or output, check the disk space usage to ensure the /var partition is not at 100% capacity.

Additional Information

To speak with a customer representative or a Support Engineer see Contact Support. Scroll to the bottom of the page and click on your respective region.