Oninit cdi / Archive
Talk to an expert →

Reset audit file number?

Posted in 2017

Summary

On Solaris 10 with IDS 12.10.FC3, the poster wanted to reset the audit log file sequence number (e.g. back to .0 instead of continuing from .7). Editing adtlog.<SERVERNUM> had no effect; after finding doc text saying numbers only repeat if you remove the audit log files and delete the ADTLOG file, he tried that too, but auditing still resumed with the next incremented number. Mike Walker suggested restarting the instance after disabling auditing (untested), and John Fahey noted onaudit -n just increments the number. No confirmed way to reset the counter is recorded.

Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.

Topics: Security, Permissions & Auditing, Platform-Specific Issues

DAVID GROVE — — source: IIUG Forums & Mailing Lists

Solaris 10 IDS 12.10FC3 Is there a way to reset the audit file number? For example, say the current audit log file is "<INFORMIXSERVER>.7". Say I desire to reset the sequence number, and have the next audit file be "<INFORMIXSERVER.0", and then continue to increment from there (as normal). I have tried turning auditing off, and then editing "adtlog.<SERVERNUM>" to contain "0" (instead of "7")-- but that doesn't work. When I turn auditing back on, the new audit log file is "<INFORMIXSERVER>.8"-- not "<INFORMIXSERVER.0". It would seem that the definitive audit file sequence number is stored some place other than "adtlog.<SERVERNUM>". I wonder where that is. I don't see any mention of this in InfoCenter documentation. Thank you for any comments. DG

↪ replying to DAVID GROVE
DAVID GROVE — — source: IIUG Forums & Mailing Lists

I did find this in the Knowledge Center: "Audit file numbers do not repeat unless you remove audit log files and delete the ADTLOG file." So, I turned auditing off, deleted all the log files and the adtlog.<SERVERNUM> file. Then restarted auditing. It picked up right were it left off with new adtlog and log files, with the sequence number incremented from where it left off. DG

↪ replying to DAVID GROVE
Mike Walker — — source: IIUG Forums & Mailing Lists

You may need to restart Informix after turning auditing off. I've done this a number of times and I normally restart the instance as a matter of course - but I don't know if that's the relevant piece or not. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of DAVID GROVE Sent: Thursday, September 21, 2017 1:15 PM To: ids@iiug.org Subject: Re: Reset audit file number? [39962] I did find this in the Knowledge Center: "Audit file numbers do not repeat unless you remove audit log files and delete the ADTLOG file." So, I turned auditing off, deleted all the log files and the adtlog.<SERVERNUM> file. Then restarted auditing. It picked up right were it left off with new adtlog and log files, with the sequence number incremented from where it left off. DG **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Mike Walker
jjfahey@gmail.com — — source: IIUG Forums & Mailing Lists

onaudit -n increments the number and keeps auditing. If you have a maxfilesize set in the ADTCFG it will increment and continue when that size is reached. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Mike Walker Sent: Thursday, September 21, 2017 3:22 PM To: ids@iiug.org Subject: RE: Reset audit file number? [39964] You may need to restart Informix after turning auditing off. I've done this a number of times and I normally restart the instance as a matter of course - but I don't know if that's the relevant piece or not. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of DAVID GROVE Sent: Thursday, September 21, 2017 1:15 PM To: ids@iiug.org Subject: Re: Reset audit file number? [39962] I did find this in the Knowledge Center: "Audit file numbers do not repeat unless you remove audit log files and delete the ADTLOG file." So, I turned auditing off, deleted all the log files and the adtlog.<SERVERNUM> file. Then restarted auditing. It picked up right were it left off with new adtlog and log files, with the sequence number incremented from where it left off. DG **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum. **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum.

↪ replying to Mike Walker
John Fahey — — source: IIUG Forums & Mailing Lists

onaudit -n increments the number and keeps auditing. If you have a maxfilesize set in the ADTCFG it will increment and continue when that size is reached. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of Mike Walker Sent: Thursday, September 21, 2017 3:22 PM To: ids@iiug.org Subject: RE: Reset audit file number? [39964] You may need to restart Informix after turning auditing off. I've done this a number of times and I normally restart the instance as a matter of course - but I don't know if that's the relevant piece or not. -----Original Message----- From: ids-bounces@iiug.org [mailto:ids-bounces@iiug.org] On Behalf Of DAVID GROVE Sent: Thursday, September 21, 2017 1:15 PM To: ids@iiug.org Subject: Re: Reset audit file number? [39962] I did find this in the Knowledge Center: "Audit file numbers do not repeat unless you remove audit log files and delete the ADTLOG file." So, I turned auditing off, deleted all the log files and the adtlog.<SERVERNUM> file. Then restarted auditing. It picked up right were it left off with new adtlog and log files, with the sequence number incremented from where it left off. DG **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum. **************************************************************************** *** Forum Note: Use "Reply" to post a response in the discussion forum.