Summary information |
|
|---|---|
Default value |
0 (off) |
Range of values |
0 (off), 1 (on) |
Status |
Dynamic |
Display level |
Intermediate |
Required role |
System security officer |
Configuration group |
Security Related |
suspend audit when device full determines what Adaptive Server does when an audit device becomes completely full.
If you have two or more audit tables, each on a separate
device other than the master device, and you have a threshold procedure
for each audit table segment, the audit devices should never become
full. Only if a threshold procedure is not functioning properly
does the “full” condition occur.
Choose one of these values:
0 – truncates the next audit table and starts using it as the current audit table when the current audit table becomes full. If you set suspend audit when device full to 0, you ensure that the audit process is never suspended. However, you incur the risk that older audit records are lost if they have not been archived.
1 – suspends the audit process and all user processes that cause an auditable event. To resume normal operation, the system security officer must log in and set up an empty table as the current audit table. During this period, the system security officer is exempt from normal auditing. If the system security officer’s actions would generate audit records under normal operation, Adaptive Server sends an error message and information about the event to the error log.
