Environment
Novell Audit 1.0.3 Secure Logging Server
Novell Audit 2.0.0 Secure Logging Server
Novell Audit 2.0.1 Secure Logging Server
Novell Audit 2.0.2 Secure Logging Server
Situation
What do the minimum, normal and maximum event cache RAM usage
bytes mean?
What is the size mean?
How does this work?
Resolution
When you look at the memory configuration for Novell Audit,
you will notice that be default there are three numbers. They
are:
10240 (Minimum)
20480 (Normal)
40960 (Maximum)
First of all, these values are in Kbytes, not bytes. So
10240 is actually 10 megabytes not 10 kilobytes.
The minimum number is the amount of RAM that the Secure
Logging Server (SLS) will take immediately when loaded. This
memory is used to store events that the SLS has received from
platform agents (PAs) but has not committed these events to the
data store.
If the SLS becomes flooded with events and the events begin to
queue up faster than they can be committed to the data store, the
SLS will almost immediately jump to the "Normal" memory
setting. By default this is 20 megabytes. If the SLS
continues to receive a high amount of events and the data store is
unable to keep up with the amount of data it is receiving, the
amount of memory consumed by the SLS will grow somewhat slowly to
the maximum amount of memory that is available to the SLS. In
a default configuration, this amount is 40 megabytes.
Depending on the amount of memory in the server you are
running and the amount of events coming in and the speed of the
data store, these default amounts may not be
large enough. Please keep in mind that the minimum
number is the minimum amount of RAM that Lengine will use and
allocate. That memory is permanently allocated to the SLS
until the SLS is shut down. If the SLS uses more memory than
the minimum, it will give that memory back to the OS once the
queued events have been processed by the data store.
Additional Information
If you do not know where the memory settings are for the SLS,
please do the following:
a.) Login to iManager. Typically this is done athttp:///nps/iManager.html .
b.) Click on the "Auditing and Logging" link.
Click on the "Logging Server Options". Browse to your Secure
Logging Server (SLS) object. Normally the SLS is located
in the "Logging Services" container just off of root. Once
you have your SLS, click on the "OK" button.
c.) Click on the "General" tab. Click on the"Memory" link. You will notice three values there.
Those values are in kilobytes, not bytes. By default the
minimum amount is 10 megabytes, the normal amount is 20 megabytes,
and the maximum about that the SLS can allocate is 40
megabytes.