4 Replies Latest reply on Jan 31, 2018 9:41 AM by Roger Palmen

    PI Data Archive Audit files - how to move them?

    Roger Palmen

      I could not find any reference i could understand on how to move audit files to a different location. Anybody ideas?

       

      And i need to do that because to my surprise the location of the audit files cannot be changed: Request Rejected

      So they end up  in the PIHOME directory where i don't have the space.

        • Re: PI Data Archive Audit files - how to move them?
          tramachandran

          You can move or delete any of these 3 audit record files if you desire, however, you first must “close” the PI Audit database files.  Otherwise, the corresponding subsystems will still hold write-locks on the files.  Generally, we recommend that you move old audit records to an external drive rather than delete them, in case you need to reference them again in the future.

          Refer to: Replace PI Audit Database files

          Tuning parameters for audit file shift

          2 of 2 people found this helpful
            • Re: PI Data Archive Audit files - how to move them?
              Roger Palmen

              What i understood from the manual is that indeed the three current files are locked. But when there is a shift, the previous files, are they closed automatically? Can i simply move these files to a different location after creation?

               

              I have no problem with leaving the current audit files in place (ecept that the storage location should be configurable of course), but i am merely looking at how to move the large pile of shifted audit files to a different location. And fot hat process i did not find much in the documentation or anywhere else.

              Are there any recommended procedures or best practices?

                • Re: PI Data Archive Audit files - how to move them?
                  afink

                  Hi Roger,

                   

                  Each subsystem responsible for auditing (snap, arc, base) will only have the current audit archives "open".  Therefore, viewing any audit file other than the current (Archive0) is considered "offline" viewing.  These older audit archives can be simply moved like any other file since these subsystems are not holding any locks on them.  The user can then add them as offline audit archives from within AuditViewer to view audit records contained in the offline audit files.

                   

                  As for your concern about lack of documentation, the best I could find was in the Auditing the PI Server Manual

                  "Copy the Audit Database files from the PI\log directory to a safe location. Because storage of the file may be part of site validation, take care to ensure safe and accountable storage. "

                   

                  This line is from page 6 discussing management of the offline audit files.  This is definitely not very specific, but a few additional notes would be that the audit files (depending on size/drives available) could be kept on a separate storage drive either on the Data Archive or on a network share.  Note the inherent possibility for performance degradation if searching remote audit files.  Since these audit files are no longer being written to, keeping them stored on a network share should be less of a concern in the case of network outages or other cases of inaccessibility.

                   

                  - Adam

                  2 of 2 people found this helpful
                    • Re: PI Data Archive Audit files - how to move them?
                      Roger Palmen

                      Ah thanks, that helps. I will create some scripting to shift the older audit archive files to the correct storage location. That is on the same server so no performance issues expected, this is mainly needed because you cannot configure the storage location in the first place!

                       

                      Yeah, did find the documentation with this particular line, but the key addition you made was on the older archive files being closed and free for moving to a different location.