Posts Tagged ‘audit log’

Clear those audit logs before it’s too late!

Saturday, March 13th, 2010

WebCenter Interaction Audit Logs are decent for tracking what’s going on in your portal, but they can grow really quickly.  So, you should make sure to configure the Audit Log to regularly purge rows from the database and write them to disk using the “Audit Manager” in the WCI portal administration page (under “Select Utility”):

audit-manager

(By the way, for that network path, remember to make sure there are no extraneous files in that directory.)

This isn’t just good practice, but it could save you some huge headaches down the line.  In particular, I’ve seen two “worst-case scenarios”:

  1. At one client with an Oracle database, there was a limit on how big the tablespace could grow for audit logs.  So as soon as this limit was hit, noone could visit the portal.  Because the portal was trying and failing to record the guest users’ “login” to the portal, it ended up throwing an exception and not allowing anyone in.
  2. The Audit Log Management job has some wildly inefficient code, which appears to load ALL rows into memory before writing them out to disk.  If the audit log in the DB grows to a certain threshold, the job to actually clear out those rows will fail with an OutOfMemory exception:

wci-audit-job1

wci-audit-job2

If you find yourself stuck in the predicament, where the audit log is too big to even clear it out through traditional means – with the Audit Log Management job – your Last Great Hope is to simply purge the DB through SQL:

delete from ptauditmsgs where auditmsgtime < '30-DEC-09'

So schedule your audit job archives now, and let’s hope you never have to resort to just dropping those records just to get users logging in and events archived again.