How to regenerate a blank AUDIT database?

Article

Sylvain Guilbaud · Aug 24, 2023 1m read

#Databases #Security #System Administration #Tips & Tricks #Caché #InterSystems IRIS #InterSystems IRIS for Health

It sometimes happens that due to an adverse event the AUDIT database (IRISAUDIT) has grown to such proportions that the disk it resides on is full and the daily purge cannot be expected to reclaim disk space.

As IRISAUDIT is a system database required at startup, there is no question of attempting to restart IRIS after simply deleting IRIS.DAT from the <IRIS ROOT>/mgr/irisaudit/ database, nor of hot swapping, by system manipulations trying to dismount, replace, remount, since it is simply not possible to dismount it.

IRISAUDIT database: mounting required when starting IRIS

IRISAUDIT base: impossible to dismount

The procedure to follow to regenerate a blank AUDIT database is as follows:

Before stopping IRIS, create a new database, ie: NEWAUDIT
Stop IRIS
Delete the IRIS.DAT file from the AUDIT database in <IRIS ROOT>/mgr/irisaudit
Copy the IRIS.DAT file from the NEWAUDIT database into <IRIS ROOT>/mgr/irisaudit
Restart IRIS
Consult the AUDIT database which now only contains start-up events

IRISAUDIT database: display of the new database containing only new start-up event

Go to the original post written by @Sylvain Guilbaud

Erase the audit file. Flags: 0 - Erase all contents 1 - Erase and create new audit file 2 - Erase and create new audit file, treat as encryption state changed Note that bit 1 infers that ALL data in the audit database will be deleted, not just Audit data

USER>zn "%sys" %SYS>w ##class(SYS.Database).%OpenId("/is/iris/mgr/irisaudit").Size 11 %SYS>w ##class(%SYS.Audit).Erase(1) 1 %SYS>w ##class(SYS.Database).%OpenId("/is/iris/mgr/irisaudit").Size 1

08/24/23-17:31:00:649 (23676) 0 [Database.FullExpansion] Expansion completed for database /is/iris/mgr/irisaudit/. Expanded by 10 MB. 08/24/23-17:33:38:885 (48001) 0 [Generic.Event] Dismounted database /is/iris/mgr/irisaudit/ (SFN 4) 08/24/23-17:33:39:955 (48001) 0 [Database.MountedRW] Mounted database /is/iris/mgr/irisaudit/ (SFN 4) read-write.

Yaron Munz · Aug 24, 2023

I would recommend that in systems that the audit database is big or huge you stop IRIS and move that database to another disk. Then change in IRIS.CPF (Database section) the location for the audit database.

1 0

Sylvain Guilbaud · Aug 24, 2023

That's also a possibility if you have this option to get another disk which will allow you to change the default IRISAUDIT database directory.

0 0

Vitaliy Serdtsev · Aug 24, 2023

What about method %SYS.Audit.Erase(Flags As %Integer = 0)?

That's the perfect answer with the appropriate API to use !! 😀
Thanks @Vitaliy Serdtsev

And in messages.log you have :