0
253

Written by

Sylvain Guilbaud
Sales Engineer at InterSystems
STAFF
Follow
Article Sylvain Guilbaud · Aug 24, 2023 1m read

How to regenerate a blank AUDIT database?

#Caché #InterSystems IRIS #InterSystems IRIS for Health #Databases #Security #System Administration #Tips & Tricks

It sometimes happens that due to an adverse event the AUDIT database (IRISAUDIT) has grown to such proportions that the disk it resides on is full and the daily purge cannot be expected to reclaim disk space.

As IRISAUDIT is a system database required at startup, there is no question of attempting to restart IRIS after simply deleting IRIS.DAT from the <IRIS ROOT>/mgr/irisaudit/ database, nor of hot swapping, by system manipulations trying to dismount, replace, remount, since it is simply not possible to dismount it.

IRISAUDIT database: mounting required when starting IRIS

IRISAUDIT base: impossible to dismount

The procedure to follow to regenerate a blank AUDIT database is as follows:

  1. Before stopping IRIS, create a new database, ie: NEWAUDIT 
  2. Stop IRIS
  3. Delete the IRIS.DAT file from the AUDIT database in <IRIS ROOT>/mgr/irisaudit
  4. Copy the IRIS.DAT file from the NEWAUDIT database into <IRIS ROOT>/mgr/irisaudit
  5. Restart IRIS
  6. Consult the AUDIT database which now only contains start-up events 

IRISAUDIT database: display of the new database containing only new start-up event

Discussion (4)0
Log in or sign up to continue

Comments

Yaron Munz · Aug 24, 2023

I would recommend that in systems that the audit database is big or huge you stop IRIS and move that database to another disk. Then change in IRIS.CPF (Database section) the location for the audit database. 

0
Sylvain Guilbaud  Aug 24, 2023 to Yaron Munz

That's also a possibility if you have this option to get another disk which will allow you to change the default IRISAUDIT database directory.

0
Vitaliy Serdtsev · Aug 24, 2023

What about method %SYS.Audit.Erase(Flags As %Integer = 0)?

Erase the audit file.
Flags: 0 - Erase all contents
1 - Erase and create new audit file
2 - Erase and create new audit file, treat as encryption state changed
Note that bit 1 infers that ALL data in the audit database will be deleted, not just Audit data
0
Sylvain Guilbaud  Aug 24, 2023 to Vitaliy Serdtsev

That's the perfect answer with the appropriate API to use !! 😀
Thanks @Vitaliy Serdtsev 

USER>zn "%sys"
%SYS>w ##class(SYS.Database).%OpenId("/is/iris/mgr/irisaudit").Size
11
%SYS>w ##class(%SYS.Audit).Erase(1)                                               
1
%SYS>w ##class(SYS.Database).%OpenId("/is/iris/mgr/irisaudit").Size
1

And in messages.log you have :

08/24/23-17:31:00:649 (23676) 0 [Database.FullExpansion] Expansion completed for database /is/iris/mgr/irisaudit/. Expanded by 10 MB.
08/24/23-17:33:38:885 (48001) 0 [Generic.Event] Dismounted database /is/iris/mgr/irisaudit/ (SFN 4)
08/24/23-17:33:39:955 (48001) 0 [Database.MountedRW] Mounted database /is/iris/mgr/irisaudit/ (SFN 4) read-write.
0