How to reduce the default retention policy for audit events using the CMT tool in VMware Cloud Foundation Automation

Products

• VCF Automation

Issue/Introduction

VCF Automation may experience excessive growth in the PostgreSQL audit_trail table, causing the database partition to reach 100% disk usage. This issue is driven by high volume of token creation events, leading to excessive growth in the audit trail database.

Environment

VCF Automation 9.0.x

VCF Automation 9.1.x

Cause

Internal services perform frequent token creations. In version 9.0, these specific audit events were not excluded from the audit trail, resulting in a large number of entries being stored in the database.

Resolution

To mitigate database growth, you can reduce the default retention policy for audit events using the Cell Management Tool (CMT).

Procedure
Warning: The following steps involve modifying configuration settings via the command line. Ensure you have a valid database backup before proceeding.

1. SSH into the VCFA server.
   
   
2. Access the tenant-manager pod by running:
   kubectl exec -i -t -n prelude tenant-manager-0 -- bash


3. Navigate to the binary directory:
   cd /opt/vmware/vcloud-director/bin


4. Launch the Cell Management Tool:
   ./cell-management-tool


5. Update the retention period (the example below sets it to 7 days; adjust the value as needed for your requirements):
   manage-config -n com.vmware.vcloud.audittrail.history.days -v 7


6. Verify the new value is applied:
   manage-config -n com.vmware.vcloud.audittrail.history.days -l



7. Exit the CMT and the pod:
   
   
   Note: Tenant Manager (TM) pods do not require a restart for these changes to take effect. It is recommended to validate the database size after 24 hours to confirm the cleanup of older records.