Smarts SAM Adapter: Unable to roll Audit logs in Smarts SCOM Adapter; How to manage huge audit logs in OAO & OAS Servers?
Article ID: 331898
Updated On:
Products
VMware Smart Assurance
Issue/Introduction
Symptoms:
Difficult to search audit logs to track recent events and response to those events.
Unable to roll Audit logs, the following commands fail when executed :
[ionix@pdc2idm001 /opt/InCharge9/SAM/smarts/lib]$ dmctl -s TFL-SOEF
Domain Manager Control Program (V9.0.1.1) -- Type 'help' for a list of commands.
Attached to 'TFL-SOEF'
dmctl> exec roll_log
dmctl> exec roll_sam_auditlog
dmctl> exec roll_audit_log
Audit logs not rolling for OAS and OAO domains.
Difficult to search audit logs to track recent events and response to those events.
Unable to roll Audit logs, the following commands fail when executed :
[ionix@pdc2idm001 /opt/InCharge9/SAM/smarts/lib]$ dmctl -s TFL-SOEF
Domain Manager Control Program (V9.0.1.1) -- Type 'help' for a list of commands.
Attached to 'TFL-SOEF'
dmctl> exec roll_log
dmctl> exec roll_sam_auditlog
dmctl> exec roll_audit_log
Audit logs not rolling for OAS and OAO domains.
Environment
VMware Smart Assurance - SMARTS
Cause
This is an issue with rolling adapter logs with the command roll_adapter_auditlog since it is not creating the .bak file.
Resolution
This is a known bug in the product and the fix is in progress. Please implement the below workaround :
1. Write a file(script) or shell script, as shown below :
Linux: copy <SAM AdapterDir>/local/logs/<SAM_Adapter_Name>.audit <SAM AdapterDir>/local/logs/<SAM_Adapter_Name>.audit. _$(date)"
Windows : copy <SAM AdapterDir>/local/logs/<SAM_Adapter_Name>.audit <SAM AdapterDir>/local/logs/ <SAM_Adapter_Name>.audit. _%date%
dmctl s <SAM Adapter> exec roll_adapter_auditlog
DMCTL command exec roll_log is available only for rolling the logs of OAS server. The OAO server configuration automatically rolls the logs based on the size. The configuration parameter is as below available in adapter.conf file.
## OpsMgr log file maximum size in bytes.
#
# Integer.
#
# typically: 2000000
#
OPS_MGR_SERVICE_MAX_LOG_SIZE = 2000000;
2. The rolling of audit log has a different command. The command to use is
dmctl s OpsMgr2007 exec roll_adapter_auditlog
This will roll the audit logs.
3. For OAS server, the OpsMgr2007 server can roll the audit_logs by executing dmctl roll_log command. Please see the below example :
Each time this command is run a new log file is created.
C:\SAMADP814\SAM.Adapters\smarts\bin>dmctl -s OpsMgr2007 exec roll_log
Server OpsMgr2007 User: admin
admin's Password: XXXXXXXX
C:\SAMADP814\SAM.Adapters\smarts\bin>dmctl -s OpsMgr2007 exec roll_log
Server OpsMgr2007 User: admin
admin's Password: XXXXXXXX
C:\InCharge\SAM.Adapters\smarts\local\logs>dir
Volume in drive C has no label.
Volume Serial Number is AE5B-5012
Directory of C:\InCharge\SAM.Adapters\smarts\local\logs
01/20/2015 11:44 PM <DIR> .
01/20/2015 11:44 PM <DIR> ..
10/29/2014 05:59 AM 5,439,276 OpsMgr2007.archive
10/13/2014 08:01 PM 5,598,942 OpsMgr2007.audit
01/20/2015 11:44 PM 9,885 OpsMgr2007_en_US_UTF-8.log
10/29/2014 01:49 AM 357,859,482 OpsMgr2007_en_US_UTF-8.log.001
01/20/2015 11:35 PM 266,375,275 OpsMgr2007_en_US_UTF-8.log.002
01/20/2015 11:44 PM 31,045 OpsMgr2007_en_US_UTF-8.log.bak
01/12/2015 07:47 PM 1,185 OpsMgrOAO.log
01/12/2015 07:47 PM 2,000,015 OpsMgrOAO.log_B1.bak
01/04/2015 04:18 PM 2,000,064 OpsMgrOAO.log_B2.bak
12/27/2014 04:46 PM 2,000,092 OpsMgrOAO.log_B3.bak
12/19/2014 01:45 PM 2,001,363 OpsMgrOAO.log_B4.bak
12/10/2014 07:15 AM 2,000,160 OpsMgrOAO.log_B5.bak
09/30/2014 03:08 AM <DIR> queueFiles
12 File(s) 645,316,784 bytes
3 Dir(s) 8,645,758,976 bytes free
C:\InCharge\SAM.Adapters\smarts\local\logs>C:\InCharge\SAM.Adapters\smarts\bin\dmctl -s OpsMgr2007 exec roll_log
Server OpsMgr2007 User: admin
admin's Password: XXXXXXXX
C:\InCharge\SAM.Adapters\smarts\local\logs>dir
Volume in drive C has no label.
Volume Serial Number is AE5B-5012
Directory of C:\InCharge\SAM.Adapters\smarts\local\logs
01/20/2015 11:46 PM <DIR> .
01/20/2015 11:46 PM <DIR> ..
10/29/2014 05:59 AM 5,439,276 OpsMgr2007.archive
10/13/2014 08:01 PM 5,598,942 OpsMgr2007.audit
01/20/2015 11:46 PM 20,805 OpsMgr2007_en_US_UTF-8.log
10/29/2014 01:49 AM 357,859,482 OpsMgr2007_en_US_UTF-8.log.001
01/20/2015 11:35 PM 266,375,275 OpsMgr2007_en_US_UTF-8.log.002
01/20/2015 11:44 PM 31,045 OpsMgr2007_en_US_UTF-8.log.003
01/20/2015 11:46 PM 10,422 OpsMgr2007_en_US_UTF-8.log.bak
01/12/2015 07:47 PM 1,185 OpsMgrOAO.log
01/12/2015 07:47 PM 2,000,015 OpsMgrOAO.log_B1.bak
01/04/2015 04:18 PM 2,000,064 OpsMgrOAO.log_B2.bak
12/27/2014 04:46 PM 2,000,092 OpsMgrOAO.log_B3.bak
12/19/2014 01:45 PM 2,001,363 OpsMgrOAO.log_B4.bak
12/10/2014 07:15 AM 2,000,160 OpsMgrOAO.log_B5.bak
09/30/2014 03:08 AM <DIR> queueFiles
13 File(s) 645,338,126 bytes
3 Dir(s) 8,645,730,304 bytes free
C:\InCharge\SAM.Adapters\smarts\local\logs>
1. Write a file(script) or shell script, as shown below :
Linux: copy <SAM AdapterDir>/local/logs/<SAM_Adapter_Name>.audit <SAM AdapterDir>/local/logs/<SAM_Adapter_Name>.audit. _$(date)"
Windows : copy <SAM AdapterDir>/local/logs/<SAM_Adapter_Name>.audit <SAM AdapterDir>/local/logs/ <SAM_Adapter_Name>.audit. _%date%
dmctl s <SAM Adapter> exec roll_adapter_auditlog
DMCTL command exec roll_log is available only for rolling the logs of OAS server. The OAO server configuration automatically rolls the logs based on the size. The configuration parameter is as below available in adapter.conf file.
## OpsMgr log file maximum size in bytes.
#
# Integer.
#
# typically: 2000000
#
OPS_MGR_SERVICE_MAX_LOG_SIZE = 2000000;
2. The rolling of audit log has a different command. The command to use is
dmctl s OpsMgr2007 exec roll_adapter_auditlog
This will roll the audit logs.
3. For OAS server, the OpsMgr2007 server can roll the audit_logs by executing dmctl roll_log command. Please see the below example :
Each time this command is run a new log file is created.
C:\SAMADP814\SAM.Adapters\smarts\bin>dmctl -s OpsMgr2007 exec roll_log
Server OpsMgr2007 User: admin
admin's Password: XXXXXXXX
C:\SAMADP814\SAM.Adapters\smarts\bin>dmctl -s OpsMgr2007 exec roll_log
Server OpsMgr2007 User: admin
admin's Password: XXXXXXXX
C:\InCharge\SAM.Adapters\smarts\local\logs>dir
Volume in drive C has no label.
Volume Serial Number is AE5B-5012
Directory of C:\InCharge\SAM.Adapters\smarts\local\logs
01/20/2015 11:44 PM <DIR> .
01/20/2015 11:44 PM <DIR> ..
10/29/2014 05:59 AM 5,439,276 OpsMgr2007.archive
10/13/2014 08:01 PM 5,598,942 OpsMgr2007.audit
01/20/2015 11:44 PM 9,885 OpsMgr2007_en_US_UTF-8.log
10/29/2014 01:49 AM 357,859,482 OpsMgr2007_en_US_UTF-8.log.001
01/20/2015 11:35 PM 266,375,275 OpsMgr2007_en_US_UTF-8.log.002
01/20/2015 11:44 PM 31,045 OpsMgr2007_en_US_UTF-8.log.bak
01/12/2015 07:47 PM 1,185 OpsMgrOAO.log
01/12/2015 07:47 PM 2,000,015 OpsMgrOAO.log_B1.bak
01/04/2015 04:18 PM 2,000,064 OpsMgrOAO.log_B2.bak
12/27/2014 04:46 PM 2,000,092 OpsMgrOAO.log_B3.bak
12/19/2014 01:45 PM 2,001,363 OpsMgrOAO.log_B4.bak
12/10/2014 07:15 AM 2,000,160 OpsMgrOAO.log_B5.bak
09/30/2014 03:08 AM <DIR> queueFiles
12 File(s) 645,316,784 bytes
3 Dir(s) 8,645,758,976 bytes free
C:\InCharge\SAM.Adapters\smarts\local\logs>C:\InCharge\SAM.Adapters\smarts\bin\dmctl -s OpsMgr2007 exec roll_log
Server OpsMgr2007 User: admin
admin's Password: XXXXXXXX
C:\InCharge\SAM.Adapters\smarts\local\logs>dir
Volume in drive C has no label.
Volume Serial Number is AE5B-5012
Directory of C:\InCharge\SAM.Adapters\smarts\local\logs
01/20/2015 11:46 PM <DIR> .
01/20/2015 11:46 PM <DIR> ..
10/29/2014 05:59 AM 5,439,276 OpsMgr2007.archive
10/13/2014 08:01 PM 5,598,942 OpsMgr2007.audit
01/20/2015 11:46 PM 20,805 OpsMgr2007_en_US_UTF-8.log
10/29/2014 01:49 AM 357,859,482 OpsMgr2007_en_US_UTF-8.log.001
01/20/2015 11:35 PM 266,375,275 OpsMgr2007_en_US_UTF-8.log.002
01/20/2015 11:44 PM 31,045 OpsMgr2007_en_US_UTF-8.log.003
01/20/2015 11:46 PM 10,422 OpsMgr2007_en_US_UTF-8.log.bak
01/12/2015 07:47 PM 1,185 OpsMgrOAO.log
01/12/2015 07:47 PM 2,000,015 OpsMgrOAO.log_B1.bak
01/04/2015 04:18 PM 2,000,064 OpsMgrOAO.log_B2.bak
12/27/2014 04:46 PM 2,000,092 OpsMgrOAO.log_B3.bak
12/19/2014 01:45 PM 2,001,363 OpsMgrOAO.log_B4.bak
12/10/2014 07:15 AM 2,000,160 OpsMgrOAO.log_B5.bak
09/30/2014 03:08 AM <DIR> queueFiles
13 File(s) 645,338,126 bytes
3 Dir(s) 8,645,730,304 bytes free
C:\InCharge\SAM.Adapters\smarts\local\logs>
Feedback
Yes
No
Powered by
