Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >

KB-4136: Procedure to recover spool file for KB-3047

Auditing and Monitoring Service ,  

12 April,16 at 11:13 AM

Applies to: All versions of DirectAudit earlier than Suite 2012.2.


What steps does one take to recover spool file when following KB-3047: DA agent in offline mode and collector returned "Offset and length were out of bounds" error


a) The Collector should be upgraded to Centrify Suite 2013.2 (DirectAudit 3.1.0). 

b) A dedicated DirectAudit 3.0.x UNIX / Linux agent machine is needed for recovery.  Ensure that no other users are currently audited, and login using a privileged account that is not audited.

c) Make sure the 3.0.x DirectAudit agent is connected to the Collector and its online.

d) Stop the DirectAudit agent service.

e) Rename /var/centrifyda/spool-dbqc.

f) Move one saved directory from step e) above to /var/centrifyda/spool-dbqc.

g) Start the DA agent service.

h) Wait for the spool data to despool completely.  One can verify if the despoiling is completed by running the command “dainfo --diag” [command is run as “root”] and check if the “Offline store size” is 0.  

i) Repeat steps (d) through (h) for the rest of the saved directories.

Still have questions? Click here to log a technical support case, or collaborate with your peers in Centrify's Online Community.