KB-8409: DirectAudit Agent online but offline store is not despooling

Home >

KB-8409: DirectAudit Agent online but offline store is not despooling

Product:

Centrify DirectAudit ,

Published:

17 March,17 at 11:26 PM

Rating:

Applies to: All versions of Centrify DirectAudit on all supported platforms

Problem:
DirectAudit Agent is showing online but offline store is not despooling showing a despool rate of 0.00 Bytes/second.

Upon running dainfo the agent shows connected however the size of the offline store (spool) is not decreasing. You already attempted to restart the agent however the same behavior is observed.
======
[root@server1 ~]# dainfo
Pinging adclient: adclient is available
Daemon status: Online
Current collector: collector1.ocean.net:5063:HOST/COLLECTOR1.ocean.net@OCEAN.NET
Offline store size: (>1MB)
Despool rate: 0.00 Bytes/second
Getting offline database information:
Size on disk: (>1MB)
Database filesystem use: (sufficient disk space)
DirectAudit NSS module: Active
User (root) audited status: Yes
DirectAudit is not configured to audit individual commands.
======

Logs will show the following error:
=====
dad[42271114]: INFO <auditbg:run-queue> cda.dad.auditor DirectAudit agent received exception reply from Collector. Data is stored locally and will be re-submitted later.
dad[42271114]: INFO <auditbg:run-queue> cda.dad.auditor Issue in despooling data: Exception from collector while despooling: Unknown or unexpected exception type. Leaving data in place. DirectAudit will try other collectors. Current collector will be considered again after 15 seconds.
=====

Cause:
The collector will reject the request to spool offline database as the auditstore database is full. Collector logs reveal the following:
=====
collector.exe[90012,10] Verbose: CollectorServer.SqlTrace: System.Data.SqlClient.SqlException: Could not allocate space for object 'dbo.RawData'.'PK_RawData' in database 'AuditStore' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.
=====

Resolution:
Remove old sessions or allocate more space to the AuditStore database.