RHEL 6.8. Open Edge 11.3.2
I am trying to archive the audit data and have no idea why it is failing let alone how to fix it.
Any ideas?
24907 $DLC/bin/proutil /db/live/mfgprod -C auditarchive "05/04/2015 14:15:42.269+11:00"
OpenEdge Release 11.3.2 as of Mon Jan 27 16:30:16 EST 2014
Archive all the records prior to 05/04/2015 14:15:42.269+11:00. (13532)
Existing file /scratch/auditdata/mfgprod.abd found in the specified directory. (13525)
Save this file if you want to keep it! (13526)
Do you want to continue (y/n)? (13527)
y
Archived 1 _Db-detail records. (13575)
Archived 419393 _Client-session records. (13576)
Archived 148 _aud-event records. (13577)
Audit archive failed. (13021)
24907
From the db log.
[2017/10/10@07:31:35.812+1100] P-26315 T-139951194593024 I AUDARCH62: (452) Login by clove on /dev/pts/8.
[2017/10/10@07:31:35.857+1100] P-14369 T-140584919328544 I APPSRV187: (7129) Usr 187 set name to mfg.
[2017/10/10@07:31:35.914+1100] P-26315 T-139951194593024 I AUDARCH62: (7129) Usr 62 set name to Audit archive.
[2017/10/10@07:31:35.915+1100] P-26315 T-139951194593024 I AUDARCH62: (7129) Usr 62 set name to clove.
[2017/10/10@07:31:35.943+1100] P-26315 T-139951194593024 I AUDARCH62: (13532) Archive all the records prior to 05/04/2015 14:15:42.269+11:00.
[2017/10/10@07:31:38.029+1100] P-12684 T-140423865509664 I APPSRV171: (7129) Usr 171 set name to mfg.
[2017/10/10@07:31:40.232+1100] P-14372 T-140218514716448 I APPSRV189: (7129) Usr 189 set name to mfg.
[2017/10/10@07:31:40.884+1100] P-26315 T-139951194593024 I AUDARCH62: (2252) Begin transaction backout.
[2017/10/10@07:31:40.888+1100] P-26315 T-139951194593024 I AUDARCH62: (2253) Transaction backout completed.
[2017/10/10@07:31:40.888+1100] P-26315 T-139951194593024 I AUDARCH62: (453) Logout by clove on /dev/pts/8.
On the top of what Valera posted, there might be a corrupted index/es of aud-audit-data table. I would suggest to run an index check of _aud-audit-data table indexes in case the run fails with -cpinternal utf-8 (if the mfgprod is utf-8).
Hi Craig,
I've seen this a lot with audit archiving and most of the time it's an index issue. You can solve this by running the auditarchive with the -nodelete option and/or running idxcheck/idxfix prior of the archiving.
Kind Regards,
John
Check this article, maybe this is your case
On the top of what Valera posted, there might be a corrupted index/es of aud-audit-data table. I would suggest to run an index check of _aud-audit-data table indexes in case the run fails with -cpinternal utf-8 (if the mfgprod is utf-8).
Hi Craig,
I've seen this a lot with audit archiving and most of the time it's an index issue. You can solve this by running the auditarchive with the -nodelete option and/or running idxcheck/idxfix prior of the archiving.
Kind Regards,
John
Hi Everyone,
I ran the extract with the suggested -cpinternal to no avail. (note I've archived the audit data successfully previous without the -cpinternal)
Now I've kicked off an proutil /db/live/mfgprod -C idxcheck table _aud-audit-data -cpinternal UTF-8
Which is going to take quite a few hours (days?) to finish.
REF:
1032 $DLC/bin/proutil /db/live/mfgprod -C auditarchive "05/04/2015 14:15:42.269+11:00" -cpinternal UTF-8
OpenEdge Release 11.3.2 as of Mon Jan 27 16:30:16 EST 2014
Archive all the records prior to 05/04/2015 14:15:42.269+11:00. (13532)
Existing file /scratch/auditdata/mfgprod.abd found in the specified directory. (13525)
Save this file if you want to keep it! (13526)
Do you want to continue (y/n)? (13527)
y
Archived 1 _Db-detail records. (13575)
Archived 420773 _Client-session records. (13576)
Archived 148 _aud-event records. (13577)
Audit archive failed. (13021)