KB-8409: DirectAudit Agent online but offline store is not despooling
Applies to: All versions of Centrify DirectAudit on all supported platforms
Problem: DirectAudit Agent is showing online but offline store is not despooling showing a despool rate of 0.00 Bytes/second.
Upon running dainfo the agent shows connected however the size of the offline store (spool) is not decreasing. You already attempted to restart the agent however the same behavior is observed. ====== [root@server1 ~]# dainfo Pinging adclient: adclient is available Daemon status: Online Current collector: collector1.ocean.net:5063:HOST/COLLECTOR1.ocean.net@OCEAN.NET Offline store size: (>1MB) Despool rate: 0.00 Bytes/second Getting offline database information: Size on disk: (>1MB) Database filesystem use: (sufficient disk space) DirectAudit NSS module: Active User (root) audited status: Yes DirectAudit is not configured to audit individual commands. ======
Logs will show the following error: ===== dad[42271114]: INFO <auditbg:run-queue> cda.dad.auditor DirectAudit agent received exception reply from Collector. Data is stored locally and will be re-submitted later. dad[42271114]: INFO <auditbg:run-queue> cda.dad.auditor Issue in despooling data: Exception from collector while despooling: Unknown or unexpected exception type. Leaving data in place. DirectAudit will try other collectors. Current collector will be considered again after 15 seconds. =====
Cause: The collector will reject the request to spool offline database as the auditstore database is full. Collector logs reveal the following: ===== collector.exe[90012,10] Verbose: CollectorServer.SqlTrace: System.Data.SqlClient.SqlException: Could not allocate space for object 'dbo.RawData'.'PK_RawData' in database 'AuditStore' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup. =====
Resolution: Remove old sessions or allocate more space to the AuditStore database.