SiteMinder : .diff files missing post upgrade

Products

• SITEMINDER

Issue/Introduction

.diff files missing post upgrade

Environment

R12.8.x

Resolution

Administrative Auditing is enabled using the XPSconfig utility

Enabling Administrative Audit Logging on the Siteminder Policy Server.

1) Log on to the Siteminder Policy Server host

2) Run XPSconfig

3) type 'xps' to enter the XPS menu

4) Make sure that 'AuditEnabled=true'

Enabling/Disabling requires a restart of the Policy Server.  Once enabled, the Administrative Audit files are created in the following directories on the Policy Server:

LINUX: <Install_Dir>/siteminder/audit/
WINDOWS: <Install_Dir\CA\siteminder\audit\

xps-<process_id>-<start_time>-<audit_sequence>.access
xps-<process_id>-<start_time>-<audit_sequence>.audit
xps-<process_id>-<start_time>-<audit_sequence>.diff
xps-<process_id>-<start_time>-<audit_sequence>.txn

If Administrative Audit Logs are configured* to be processed automatically, then every time the housekeeping thread** runs the following will occur:

* Automatic Audit log processing is configured when the following files are copied fom [<Install_Dir>\siteminder\audit\samples\]  into the '/audit' directory

LINUX: 
<Install_Dir>/siteminder/audit/harvest.sh
<Install_Dir>/siteminder/audit/ProcessAudit.pl
<Install_Dir>/siteminder/audit/Categories.txt

WINDOWS: 
<Install_Dir\CA\siteminder\audit\harvest.bat
<Install_Dir\CA\siteminder\audit\ProcessAudit.pl
<Install_Dir\CA\siteminder\audit\Categories.txt

** XPSSweeper will trigger the housekeeping thread, otherwise it runs regularly.

1) The first time it is run, the following directories are created automatically:

LINUX: 
<Install_Dir>/siteminder/audit/audit_archive
<Install_Dir>/siteminder/audit/audit_R6tmp

WINDOWS: 
<Install_Dir/CA/siteminder/audit/audit_archive
<Install_Dir/CA/siteminder/audit/audit_R6tmp

2) The *.Access, *.audit, & *.txn files are processed and moved into the '/audit_R6atchive' directory

I've tested this process in r12.8.7 and see the .diff files present.  They remain in the '/audit/ ' directory.

###### REFERENCES ######

https://techdocs.broadcom.com/us/en/symantec-security-software/identity-security/siteminder/12-8/configuring/policy-server-configuration/configure-the-policy-server-log-smps-log-and-audit-log-smaccess-log.html