Frequent TSS9209I AUDIT FILE HAS WRAPPED Messages With Top Secret

Products

• Cleanup
• Top Secret
• Top Secret - LDAP
• Top Secret - VSE

Issue/Introduction

The TSS9209I AUDIT FILE HAS WRAPPED message (or TSS9208I AUDIT/TRACKING FILE, AUDIT/AUDIT2, AT LEAST 90% FULL) is occurring frequently.

Is this causing a loss of data if the message is occurring more than once a day?
How do you find what is causing the audit files to fill up regularly?

Environment

Release:
Component: AWAGNT

Resolution

If the audit file is wrapping more than once a day, it is possible data is lost. The following is recommended:

Run TSSUTIL with EVENT(ALL) to see what's being logged. Decide if everything that is logged should continue to be logged. If not, take out the source of the logging.

For example, LOG(ACCESS) logs all resource accesses except a few resources. If it is not desired to have all these accesses logged, take ACCESS out of the LOG control option.

If it is desired to have everything logged, continue to be logged, then do one of the following:

Allocate a larger audit file and recycle CA Top Secret pointing to the new audit file.

Allocate a second audit file and concatenate this in the CA Top Secret startup proc with the first audit file using AUDIT and AUDIT2 DD statements. (This also requires a recycle of TSS to pick up.)

When one file wraps, a TSS9203I SWITCHED TO AUDIT/TRACKING OUTPUT FILE dddddddd is issued and the new audit records are written to the other file.

An automations package could be set up to intercept this message and backup the audit file from the file that just wrapped.