Cannot open audit file

[Former Member]

Hello Friends,

As a part of re-platform activity our production application servers are moved from AIX to Windows operating system. But CI is still in AIX.

From the next day of re-platform activity we are getting the SM21 error log as "Cannot open audit file: /migrate/<SID>/audit/log\<DATE>.AUD. This log is generating only on Windows application servers and not on CI(AIX).

All the file systems are properly mounted from AIX to Windows.

DIR_AUDIT parameter value also maintained in default profile as /migrate/<SID>/audit/log

Can any one please suggest

Thanks in advance,

Mahi.

[desiree_matas]

Hello Mahi,

Please, check the value of profile parameter DIR_AUDIT, I think it has a typo in one of the slashes (between log and .AUD

Regards,

Désiré

[Former Member]

Hi

I have checked the parameter value DIR_AUDIT and it is as /migrate/<SID>/audit/log. It is maintained only in Default profile of the System. In RZ11 I can see that this parameter is valid for all operating systems.

In windows operating systems path should be like \migrate\<SID>\audit\log\<Date>.AUD. So I.e. the reason why it is showing SM21 error log as /migrate/PR0/audit/log\<date>.AUD. Till the path /migrate/PR0/audit/log it picks from the DIR_AUDIT and which is a operating system independent.

So any other suggestions for me? Can it be solved by maintaining this parameter as \migrate\<SID>\audit\log\ in all instance profiles except CI (AIX)?

[Former Member]

Hi ,

Some parameters which might help you for this"

Name Description

FN_AUDIT Name of security audit file audit_++++++++

DIR_AUDIT Directory for security audit files

*rsau/enable Enable Security Audit*

rsau/max_diskspace/local Maximum space for security audit file

rsau/max_diskspace/per_day Maximum size of all security audit files per day

rsau/max_diskspace/per_file Maximum size of one single security audit file

rsau/selection_slots Number of selection slots for security audit

rsau/user_selection Defines the user selection method used inside kernel functions

Also refer to the SAP Note:: 539404 - FAQ: Answers to questions about the Security Audit Log

Please do the cross check of the related param's and also check the SAP note which might be very helpful.

Regards,

Sanjeev Nagalikar

[Former Member]

Start Tx RSPFPAR and enter DIR_AUDIT.

Check the value of this parameter and if the value is incorrect, look in the

DEFAULT and INSTANCE Profiles and see if this parameter exists. If the

parameter does exist correct the value. If the parameter does not exist, at

the parameter with the correct Drive and path.

You will have to restart the system to activate the parameter.

Let me know if this works

Sanjeev Nagalikar