Service_audit log concern

1

My Dear Comrades,

Hope you can help me on this.

Based on the documentation:

The default size of an audit log file is 100 MB. You can change the value by using the setting _Audit_Logging_LogMaxSize. When the size reaches it maximum value, the log file is renamed and a new file is created as server_audit.YYYYMMDDHHMM.

When checked “server_audit.log” there’s no history from the previous weeks. The erver_audit.log is only 2KB.
No related found about audit logging in client setting. It’s a windows server.

My question is there any way causing it? where can I check it. How can I resolve it. Adding _Audit_Logging_LogMaxSize might not be the solution since my log is only a 2KB file.

Thanks in advance.

2

What version of BigFix server is running?

Are there entries in the server_audit.log? Do an operation that gets audited - like deleting an action - and check whether that is added to the log.

1 Like
3

Each time need to write in the server_audit.log file, the server checks the size of this file and in case rename it, starting to write in a new empty file … This to avoid this log file became too large ( it is a sort of log file rotation ) … the LogMaxSize setting permits just to modify the max size of this file, nothing else … If there’s no history in that file, this have nothing to do with this setting …

1 Like
4

Yes, there’s entries too also tried to delete old action and it was added on the log.

5

Sounds like it’s working as expected then?

6

Is there any other way why the server_audit.log is only 2KB since the default size is 100 MB?

7

My reading is that the log file isn’t 100MB by default.

The 100MB refers to the maximum size before it gets archived and a new file created.

The file will grow as entries are added - it certainly won’t start at 100MB.

8

Yes, it’s kinda work but still I didn’t know why some history of server_audit.log was removed.

9

Definitely Bigfix does not delete stuff from the server_audit.log file …
One thought is that, if something is in edit on the file or the AV exclusion is not correctly in place, the server could be not able to write on that file … is it possible?
https://help.hcltechsw.com/bigfix/9.5/platform/Platform/Config/c_real_time_av.html

1 Like