TSS9221W ECSA Shortage due to Excessive Logging - Events may be lost

Products

• Top Secret

Issue/Introduction

Excessive logging over an extended period of time can cause ECSA exhaustion. If an ECSA Short-On-Storage (SOS) condition is realized, Top Secret issues the following message once every 30 seconds as long as the SOS condition exists.

TSS9221W ECSA Shortage due to Excessive Logging - Events may be lost

Resolution

When the ECSA exhaustion has been alleviated, Top Secret will resume normal log processing. ESCA is filling up because records are not being written as fast as they are being audited. Once the auditing slows down and the records that are being held in ESCA get written to the Audit file, then ESCA should go back to normal.

Most likely the ESCA shortage is caused by the Audit attribute on active acids or ACTION(AUDIT) on facility permits.

To identify acids with the Audit attribute:

   TSS WHOHAS AUDIT  

To find all permits with ACTION(AUDIT) and ACTION(AUDIT) on any Facility permits (TSS ADD(acid) FAC(fac), you will need to run TSSCFILE during off peak hours with the following input:

   TSS LIST(ACIDS) DATA(BASIC,XAUTH)  

Permits with ACTION(AUDIT) will have a record id of 2016 and in columns 49 through 56, it will say AUDIT.

If for some reason you do not find any auditing taking place, or if you reduce the amount of auditing and ECSA does not resume to normal, then an issue needs to be opened with Top Secret Support and an SVC dump of the Top Secret address space during the SOS condition will be needed. To get this, issue:

    TSS MODIFY SVCDUMP

or, from the console, issue:

     F TSS,SVCDUMP