HP OpenVMS Systems

System (Listener) Overloaded by Security Auditing?

» close window

The Question is:

 
Hi Wiz,
 
I have an audit listener process that is occasionally suspended by the audit
 server. I think my process MBX gets overloaded during a big peak in traffic
 (backup reading lots of files with access monitoring ACE's).
 
So the audit server goes RWMBX and the listener (plus any job causing audit
 entries) goes SUSP.
 
Deadlock, till I set the listener nosusp a few times then it all recovers nicely.
 
Any recommendations? If its to set the listener PCB$V_NOSUSPEND I would be
 happy with that but I don't know how?
 
Regards
 
Bob

The Answer is :

 
  Preventing an overloaded process from being suspended is not a
  particular solution to what appears to be an overloaded system
  configuration.
 
  You will need to determine how to accellerate the processing of
  your audit listener, or -- assuming the failure mode of the audit
  server is set for WAIT at present -- reset the audit server failure
  mode to IGNORE.  Increasing the performance involves determining
  the particular performance bottlenecks (hardware and/or software),
  and removing them -- standard tuning.
 
  You could also reduce the volume of auditing messages generated,
  or you could acquire additional processing (eg: a faster Alpha)
  and/or adjunct system hardware (eg: memory) upgrades.
 
  You will also want to apply the mandatory ECO kits for OpenVMS,
  of course.

  

     

     
answer written or last revised on ( 7-JAN-2004 )
     
» close window