· Aug 24 1m read

How to regenerate a blank AUDIT database?

It sometimes happens that due to an adverse event the AUDIT database (IRISAUDIT) has grown to such proportions that the disk it resides on is full and the daily purge cannot be expected to reclaim disk space.

As IRISAUDIT is a system database required at startup, there is no question of attempting to restart IRIS after simply deleting IRIS.DAT from the <IRIS ROOT>/mgr/irisaudit/ database, nor of hot swapping, by system manipulations trying to dismount, replace, remount, since it is simply not possible to dismount it.

IRISAUDIT database: mounting required when starting IRIS

IRISAUDIT base: impossible to dismount


The procedure to follow to regenerate a blank AUDIT database is as follows:

  1. Before stopping IRIS, create a new database, ie: NEWAUDIT 
  2. Stop IRIS
  3. Delete the IRIS.DAT file from the AUDIT database in <IRIS ROOT>/mgr/irisaudit
  4. Copy the IRIS.DAT file from the NEWAUDIT database into <IRIS ROOT>/mgr/irisaudit
  5. Restart IRIS
  6. Consult the AUDIT database which now only contains start-up events 

IRISAUDIT database: display of the new database containing only new start-up event

Discussion (4)1
Log in or sign up to continue

That's the perfect answer with the appropriate API to use !! 😀
Thanks @Vitaliy Serdtsev 

USER>zn "%sys"
%SYS>w ##class(SYS.Database).%OpenId("/is/iris/mgr/irisaudit").Size
%SYS>w ##class(%SYS.Audit).Erase(1)                                               
%SYS>w ##class(SYS.Database).%OpenId("/is/iris/mgr/irisaudit").Size

And in messages.log you have :

08/24/23-17:31:00:649 (23676) 0 [Database.FullExpansion] Expansion completed for database /is/iris/mgr/irisaudit/. Expanded by 10 MB.
08/24/23-17:33:38:885 (48001) 0 [Generic.Event] Dismounted database /is/iris/mgr/irisaudit/ (SFN 4)
08/24/23-17:33:39:955 (48001) 0 [Database.MountedRW] Mounted database /is/iris/mgr/irisaudit/ (SFN 4) read-write.