Auditing Errors

This section contains error messages pertaining to Adaptive Server auditing. Refer to the Security Administration Guide for more information about auditing.




Error 7618

Severity

20

Message text

The audit process is not currently active. Contact a user with System Administrator (SA) or System Security Officer (SSO) role.

Explanation

When auditing is required, an audit record is allocated on the stack and filled in with information which varies depending upon the type of event. Adaptive Server formats the record into an audit buffer (the audit queue) and places this buffer in the audit process mailbox.

If the audit process is not active when auditing is required, Adaptive Server terminates the user's process because it should have audited whatever was happening but could not do so. A message is sent to the error log indicating that an audit has been missed, and Error 7618 is raised.

Although there can be a number of reasons why the audit process is not active, the most common reason is that the sysaudits table has run out of space and the audit device is full. This can happen if you do not regularly archive your audit data.

Action

If the audit process died abnormally, there will be audit error messages in the Adaptive Server error log. Look for audit errors in your error log. If it looks like the audit process died abnormally, shut down and restart Adaptive Server, and then run sp_who to determine whether the audit process is active.

If it looks like the audit process did not die abnormally, determine whether the sybsecurity database is full (if that is the case, you will probably see 1105 errors in the error log):

1> sp_spaceused sybsecurity
2> go

If the sybsecurity database is full, the System Security Officer should do the following:

  1. Archive and truncate the sysaudits table.

  2. Shut down Adaptive Server.

  3. Have the System Administrator restart Adaptive Server.

If the sybsecurity database is not full and the audit process did not die abnormally or does not restart when you restart Adaptive Server, call Sybase Technical Support.

Additional information

Refer to the Adaptive Server Enterprise Security Administration Guide for information about auditing, including how to archive audit data.

Versions in which this error is raised

All versions