Centrify

Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-4136: Procedure to recover spool file for KB-3047

Auditing and Monitoring Service ,  

12 April,16 at 11:13 AM 


 
Applies to: All versions of DirectAudit earlier than Suite 2012.2.

Question:

What steps does one take to recover spool file when following KB-3047: DA agent in offline mode and collector returned "Offset and length were out of bounds" error

Answer:

a) The Collector should be upgraded to Centrify Suite 2013.2 (DirectAudit 3.1.0). 

b) A dedicated DirectAudit 3.0.x UNIX / Linux agent machine is needed for recovery.  Ensure that no other users are currently audited, and login using a privileged account that is not audited.

c) Make sure the 3.0.x DirectAudit agent is connected to the Collector and its online.

d) Stop the DirectAudit agent service.

e) Rename /var/centrifyda/spool-dbqc.

f) Move one saved directory from step e) above to /var/centrifyda/spool-dbqc.

g) Start the DA agent service.

h) Wait for the spool data to despool completely.  One can verify if the despoiling is completed by running the command “dainfo --diag” [command is run as “root”] and check if the “Offline store size” is 0.  

i) Repeat steps (d) through (h) for the rest of the saved directories.
 

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.

Related Articles

 articleKB-4835: Procedure for properly deleting the offline store from a DirectAudit agent articleKB-4879: DirectAudit Agent online but offline store is not despooling after improper shutdown articleKB-1921: Direct audit db size is growing even after disabling auditing at zone level articleKB-6041: How to show current license type in use by adclient articleKB-6040: How to change the license type in use after adclient successful joined to the AD? articleKB-6056: How to report the group policy settings that are in effect for the local computer? articleKB-6073: How to join the Linux/Unix Centrify Server to Active Directory with specific Computer Role? articleKB-6038: How to specify the license type to use when joining the server to AD using adjoin? articleKB-4018: DirectAudit Session logging (scp file stream content) can cause excessive DB usage