Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-4105: Questions on Centrify DirectAudit system audited data cache when the collector is not available.

Centrify DirectAudit ,  

24 January,14 at 06:37 AM

Applies to:

All versions of Centrify DirectAudit.
 

Questions:

I understand, centrify audit will cache while collector is unavailable. The question I have are:
 
1. Can we configure a separate disk for the cache?  If we decide to use root disk for cache, will it not fill the root file system to 100% making it unbootable?
Also, it would be nice to know a recommended way to store local cache without impacting hosts itself.

2. Can I change the path of spool/cache?

From
/var/centrifyda/spool.dbqc
To
/log/centrifyda/spool.dbqc

 

3. Can I disable the offline cache or local storage? , Is setting  spool.diskspace.min: 0 sufficient to disable spool ?
 
Answers:

1. Can we configure a separate disk for the cache? If we decide to use root disk for cache, will it not fill the root file system to 100% making it unbootable? A
Also, it would be nice to know a recommended way to store local cache without impacting hosts itself.
 
When the auditing infrastructure is down, DirectAudit daemon (dad) spools audit data locally until a collector is available. The audited data is written to the following locations on the local system
 
DirectAudit 3.x:
For Windows Agent:
C:\ProgramData\Centrify\DirectAudit\Spool

For Unix:
/var/centrifyda/spool.dbqc

If the UNIX agent is unable to connect to a collector, it spools the session data to local storage.When a collector becomes available, it then sends the spooled data to that collector.

By default, the minimum amount of allocated disk space that must be available to the offline database before spooling stops and warnings are posted to the agent error log is 10%.The percentage of minimum amount of allocated disk space can be changed by assigning a different value to spool.diskspace.min in the /etc/centrifyda/centrifyda.conf file.

For example, to change the minimum to 15%, set the following value:

 spool.diskspace.min: 15

If the threshold is reached and a collector is still not available, the agent stops spooling data, and further audit data is lost. If this happens frequently or unexpectedly,  then increase the disk space allocation. 

Adjust the disk space requirements higher if a large amount of offline storage is allocated to use when none of the collectors servicing the audit store can be reached.

This and other parameters are in a text file named centrifyda.conf in /etc/centrifyda on each audited computer that has the UNIX agent installed.
 

2. Can I change the path of spool/cache ?

From
/var/centrifyda/spool.dbqc
To
/log/centrifyda/spool.dbqc


Yes. The path for the spool/cache can be changed by modifying the parameter dad.data.dir in /etc/centrifyda/centrifyda.conf

dad.data.dir: /var/centrifyda
 

3. Can I disable the offline cache or local storage? , Is setting spool.diskspace.min: 0 sufficient to disable spool ?
 
No. By default Centrify DirectAudit spool to local disk and then to collector.

The default spool.diskspace.min is 10%.If the concern is really about filling up disk space, then please set the threshold parameters in /etc/centrifyda/centrifyda.conf
 
spool.diskspace.min : ( default is 10 %)

spool.diskspace.max:


This configuration parameter specifies maximum disk space in bytes to allocate to the offline storage database. Use 0 to designate no limit. The default value is 0 (unlimited).

For information about all of the auditing configuration parameters available to customize auditing, see the Centrify Suite Configuration and Tuning Reference Guide.

Centrify Suite 2015 Configuration and Tuning Reference Guide
Centrify Suite 2016 Configuration and Tuning Reference Guide 

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.