Usage Note 69584: Maintenance recommendations for the Audit Service
 |  |  |  |
This SAS Note provides maintenance recommendations for the Audit Service.
SAS recommends that customers streamline their audit archive process to decrease the number of records archived at each scheduled interval. Refer to the SAS Middle-Tier Administration Guide - Configure Auditing for SAS Web Applications for details.
This recommendation applies for any solution that uses the audit service, but SAS® Visual Analytics is the most common default user. SAS Visual Analytics 7.5: Administration contains some specific SAS Visual Analytics recommendations.
Caution:
Audit data can consume significant amounts of disk space and processing capacity.
To manage the sizes of the audit archive tables in the SAS® Web Infrastructure Platform SharedServices database, you must periodically purge records from those tables.
Note: Predefined rules cause audit records that are older than 30 days to be archived, subject to the following constraints:
- Predefined rules apply to only actions that SAS Visual Analytics audits, sign-in actions, and sign-out actions. (Sign-in and sign-out actions are not included in the SAS Visual Analytics extraction of audit records or the SAS Visual Analytics administrative reports.)
- Predefined rules are not provided for sites that use a SAS Web Infrastructure Platform database other than PostgreSQL.
- Predefined rules do not replace any existing site-specific custom archive rules.
Note: For which ID values to use in the archive rules, see Audit Type IDs. The suggested value for FREQUENCY_NO is 2592000000 milliseconds (30 days).
- On the autoload host, start the scheduled task that deletes old records from the full AUDIT_VISUALANALYTICS table. See Start auditRefresh.
- Set the property va.AuditingEnabled to true. See How to Set Configuration Properties, which is also summarized in SAS Note 58599.
The documentation asks customers to purge records periodically to prevent memory issues. SAS Note 58589, which is referenced by the customer, states the following:
SAS Technical Support recommends that you purge records in the SAS audit tables periodically to keep those tables at a manageable size. However, if you have a business need to maintain a certain amount of data in those tables, you can increase that maximum heap value accordingly to avoid any problems.
The audit service admin guide states the following:
After auditing has been enabled for some time and the audit archive process runs, you might want to delete records from the SAS_AUDIT_ARCHIVE and SAS_AUDIT_ENTRY_ARCHIVE tables. Purging records that are no longer needed recovers some archival space and facilitates better audit trail management.
According to the audit admin guide, if the SAS Web Infrastructure Platform database becomes completely full and audit records cannot be inserted, the audited actions cannot be successfully executed until the audit trail is purged. The system administrator must control the rate of increase and size of the audit trail. To control the size of the audit trail, consider the following strategies:
- Be selective about which actions you enable for auditing. If the number of audited actions is reduced, then unnecessary and useless audit records are not generated and are not stored in the audit trail.
- Design archive rules to move important, but not critically important, information out of the audit trail. This process archives the audit records of interest and removes them from the main audit table. For information about archiving, see Configure Auditing for SAS Web Applications.
- Purge the audit archive tables as needed.
If the records do not map to the archive rules, assume that they are not critically important and would correlate to the records that should be purged periodically from the main audit tables to prevent them from getting too large.
Since the archive process scans the main tables and moves records based on the archive rules, the size of the main audit tables would have the biggest effect on performance. Moving non-critical records that are not important to the audit trail rather than purging them from the main tables should not make any difference as long as they are not required as part if the audit trail. Assuming that only important records are archived based on the rules, moving them out periodically to a different table should also not be a problem either.
The bottom line is that, if the records are not part of the audit trail (such as audit report queries) or are no longer part of the audit trail based on the archive rules, there is no reason that customers could not save them elsewhere rather than purge them. In fact, purging or moving the records only enhances performance. Increasing the heap size is required only if the records are required for audit reporting/audit trail.
In summary, SAS recommends the following:
- Customers should review the rules data to ensure that all rules are still relevant and note that there are some pre-defined rules for SAS Visual Analytics. If customers are not explicitly using the archived data, some rules might be deleted.
- The rules data shows how often the audit archives are triggered (every 30 days is the recommended default value). Customers should evaluate the archive data based on dates to determine how many records are archived in each session. They can adjust the frequency to prevent lengthy archive sessions with large numbers of records.
- Customers should periodically purge any source records that are not archived. This prevents potential memory issues as cautioned in the SAS® Visual Analytics 7.5: Administration and Middle-Tier Administration Guides.
Operating System and Release Information
| Product Family | Product | System | SAS Release | |
| Reported | Fixed* | |||
| SAS System | SAS Web Infrastructure Platform | z/OS | ||
| Microsoft® Windows® for x64 | ||||
| Microsoft Windows 8 Enterprise 32-bit | ||||
| Microsoft Windows 8 Enterprise x64 | ||||
| Microsoft Windows 8 Pro 32-bit | ||||
| Microsoft Windows 8 Pro x64 | ||||
| Microsoft Windows 8.1 Enterprise 32-bit | ||||
| Microsoft Windows 8.1 Enterprise x64 | ||||
| Microsoft Windows 8.1 Pro 32-bit | ||||
| Microsoft Windows 8.1 Pro x64 | ||||
| Microsoft Windows 10 | ||||
| Microsoft Windows 11 | ||||
| Microsoft Windows 95/98 | ||||
| Microsoft Windows 2000 Advanced Server | ||||
| Microsoft Windows 2000 Datacenter Server | ||||
| Microsoft Windows 2000 Server | ||||
| Microsoft Windows 2000 Professional | ||||
| Microsoft Windows NT Workstation | ||||
| Microsoft Windows Server 2003 Datacenter Edition | ||||
| Microsoft Windows Server 2003 Enterprise Edition | ||||
| Microsoft Windows Server 2003 Standard Edition | ||||
| Microsoft Windows Server 2003 for x64 | ||||
| Microsoft Windows Server 2008 | ||||
| Microsoft Windows Server 2008 R2 | ||||
| Microsoft Windows Server 2008 for x64 | ||||
| Microsoft Windows Server 2012 Datacenter | ||||
| Microsoft Windows Server 2012 R2 Datacenter | ||||
| Microsoft Windows Server 2012 R2 Std | ||||
| Microsoft Windows Server 2012 Std | ||||
| Microsoft Windows Server 2016 | ||||
| Microsoft Windows Server 2019 | ||||
| Microsoft Windows Server 2022 | ||||
| Microsoft Windows XP Professional | ||||
| Windows 7 Enterprise 32 bit | ||||
| Windows 7 Enterprise x64 | ||||
| Windows 7 Home Premium 32 bit | ||||
| Windows 7 Home Premium x64 | ||||
| Windows 7 Professional 32 bit | ||||
| Windows 7 Professional x64 | ||||
| Windows 7 Ultimate 32 bit | ||||
| Windows 7 Ultimate x64 | ||||
| Windows Millennium Edition (Me) | ||||
| Windows Vista | ||||
| Windows Vista for x64 | ||||
| 64-bit Enabled AIX | ||||
| 64-bit Enabled Solaris | ||||
| HP-UX IPF | ||||
| Linux for x64 | ||||
| Solaris for x64 | ||||
| Type: | Usage Note |
| Priority: |
| Date Modified: | 2022-10-17 10:56:39 |
| Date Created: | 2022-09-26 09:35:41 |