Our CA Top Secret AUDIT file is way to small for the amount of logging being done.
Would there be any issue with adding a secondary AUDIT file to the 5 CA Top Secret systems at different times so they do not have to schedule multiple outages at the same time.
Yes you can add a second Audit file.
Most sites have 2 Audit files.
The first is the main Audit file. The second Audit file is switched to when the first Audit file is full.
When the first Audit file becomes full, then its time to archive/backup the audit entries. Once the archive/backup is done, you switch back to the first Audit file.
The best way to introduce the secondary Audit File is to: