KBI 312134 Excessive Audit Events on Solaris Queue Engine
Version
Argent Solaris Queue Engine all versions
Date
Wednesday, 15 November 2023
Summary
In environments using Solaris Queue Engines where there may be large number of Jobs being submitted and executed at a time, users may notice large numbers of read and write events in their audit logs being captured for one or more of the following paths:
- /opt/ARGTqe/logs
- /opt/ARGTqe/jobdef
- /opt/ARGTqe/dbf
In extreme cases, the number of audited events may become so excessive that it rapidly consumes the available space on the partition where the logs are located.
In such a scenario, Argent strongly recommends that the user turn off auditing on one or more of the above-mentioned paths.
Technical Background
The following provides an explanation for how each of the paths are used by the Solaris Queue Engine:
- /opt/ARGTqe/logs – This holds the log files of Argent Solaris Queue Engine which is updated when a Job is submitted or executed
- /opt/ARGTqe/jobdef – This is a temporary folder which contains the status of Jobs with Job number. This is updated when a Job is submitted or executed.
- /opt/ARGTqe/dbf – This is the database for Argent Solaris Queue Engine which is updated when a Job is submitted or executed
Resolution
Turn off Read and Write auditing on one or more of the above-mentioned paths
For further assistance, please contact Argent on Instant Help at
https://Instanthelp.Argent.com/