Centrify

Tips for finding Knowledge Articles

  • - Enter just a few key words related to your question or problem
  • - Add Key words to refine your search as necessary
  • - Do not use punctuation
  • - Search is not case sensitive
  • - Avoid non-descriptive filler words like "how", "the", "what", etc.
  • - If you do not find what you are looking for the first time,reduce the number of key words you enter and try searching again.
  • - Minimum supported Internet Explorer version is IE9
Home  >
article

KB-8409: DirectAudit Agent online but offline store is not despooling

Auditing and Monitoring Service ,  

17 March,17 at 11:26 PM

Applies to: All versions of Centrify DirectAudit on all supported platforms
 
Problem:
DirectAudit Agent is showing online but offline store is not despooling showing a despool rate of 0.00 Bytes/second.

Upon running dainfo the agent shows connected however the size of the offline store (spool) is not decreasing. You already attempted to restart the agent however the same behavior is observed. 
 ======
[root@server1 ~]# dainfo 
Pinging adclient: adclient is available 
Daemon status: Online 
Current collector: collector1.ocean.net:5063:HOST/COLLECTOR1.ocean.net@OCEAN.NET
Offline store size: (>1MB) 
Despool rate: 0.00 Bytes/second 
Getting offline database information: 
Size on disk: (>1MB) 
Database filesystem use: (sufficient disk space)
DirectAudit NSS module: Active 
User (root) audited status: Yes 
DirectAudit is not configured to audit individual commands. 
======

Logs will show the following error:
=====
dad[42271114]: INFO <auditbg:run-queue> cda.dad.auditor DirectAudit agent received exception reply from Collector. Data is stored locally and will be re-submitted later.
dad[42271114]: INFO <auditbg:run-queue> cda.dad.auditor Issue in despooling data: Exception from collector while despooling: Unknown or unexpected exception type. Leaving data in place. DirectAudit will try other collectors. Current collector will be considered again after 15 seconds.
=====

Cause:
The collector will reject the request to spool offline database as the auditstore database is full. Collector logs reveal the following:
=====
collector.exe[90012,10] Verbose: CollectorServer.SqlTrace: System.Data.SqlClient.SqlException: Could not allocate space for object 'dbo.RawData'.'PK_RawData' in database 'AuditStore' because the 'PRIMARY' filegroup is full. Create disk space by deleting unneeded files, dropping objects in the filegroup, adding additional files to the filegroup, or setting autogrowth on for existing files in the filegroup.
=====

Resolution:
Remove old sessions or allocate more space to the AuditStore database. 

Related Articles

 articleKB-4879: DirectAudit Agent online but offline store is not despooling after improper shutdown articleKB-4380: Centrify dad daemon is running but dainfo shows it is offline articleKB-4835: Procedure for properly deleting the offline store from a DirectAudit agent article[TIPS] A Centrify Server Suite Cheat Sheet articleUnderstanding DAINFO Output articleKB-20210: Common Questions Regarding Centrify DirectControl and CoreOS articleKB-7441: List of error codes Adclient and DAD daemons generated for Solaris and Linux clients articleKB-2109: Are there any sizing guides to help plan for scalability and storage requirements for DirectAudit? articleKB-6041: How to show current license type in use by adclient