<html xmlns:v="urn:schemas-microsoft-com:vml" xmlns:o="urn:schemas-microsoft-com:office:office" xmlns:w="urn:schemas-microsoft-com:office:word" xmlns:m="http://schemas.microsoft.com/office/2004/12/omml" xmlns="http://www.w3.org/TR/REC-html40">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8">
<meta name="Generator" content="Microsoft Word 15 (filtered medium)">
<!--[if !mso]><style>v\:* {behavior:url(#default#VML);}
o\:* {behavior:url(#default#VML);}
w\:* {behavior:url(#default#VML);}
.shape {behavior:url(#default#VML);}
</style><![endif]--><style><!--
/* Font Definitions */
@font-face
{font-family:"Cambria Math";
panose-1:2 4 5 3 5 4 6 3 2 4;}
@font-face
{font-family:Calibri;
panose-1:2 15 5 2 2 2 4 3 2 4;}
/* Style Definitions */
p.MsoNormal, li.MsoNormal, div.MsoNormal
{margin:0in;
margin-bottom:.0001pt;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
a:link, span.MsoHyperlink
{mso-style-priority:99;
color:blue;
text-decoration:underline;}
a:visited, span.MsoHyperlinkFollowed
{mso-style-priority:99;
color:purple;
text-decoration:underline;}
p.msonormal0, li.msonormal0, div.msonormal0
{mso-style-name:msonormal;
mso-margin-top-alt:auto;
margin-right:0in;
mso-margin-bottom-alt:auto;
margin-left:0in;
font-size:11.0pt;
font-family:"Calibri",sans-serif;}
span.EmailStyle18
{mso-style-type:personal-reply;
font-family:"Calibri",sans-serif;
color:windowtext;}
.MsoChpDefault
{mso-style-type:export-only;
font-family:"Calibri",sans-serif;}
@page WordSection1
{size:8.5in 11.0in;
margin:1.0in 1.0in 1.0in 1.0in;}
div.WordSection1
{page:WordSection1;}
--></style><!--[if gte mso 9]><xml>
<o:shapedefaults v:ext="edit" spidmax="1026" />
</xml><![endif]--><!--[if gte mso 9]><xml>
<o:shapelayout v:ext="edit">
<o:idmap v:ext="edit" data="1" />
</o:shapelayout></xml><![endif]-->
</head>
<body lang="EN-US" link="blue" vlink="purple">
<div class="WordSection1">
<p class="MsoNormal">When downloading, it appears in host\date\audit\informixauditlogs<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">To answer your other question, yes, we have them turned up and tuned to what we think works best with our Uplinx deployment.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">We’ve been running fine for about a year now. All other nodes are less than 30% utilization. Something happened that made this host go nuts some time before 5pm. And then stop. Great.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal">The host in question is a subscriber, there should not be that many db changes initiated from this guy.<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">---<o:p></o:p></span></p>
<p class="MsoNormal"><b><span style="font-family:"Arial",sans-serif">Lelio Fulgenzi, B.A.</span></b><span style="font-family:"Arial",sans-serif"> | Senior Analyst<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif;color:#333333">Computing and Communications Services</span><span style="font-family:"Arial",sans-serif"> | University of Guelph<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif">519-824-4120 Ext. 56354 |
<a href="mailto:lelio@uoguelph.ca"><span style="color:#0563C1">lelio@uoguelph.ca</span></a><o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><a href="http://www.uoguelph.ca/ccs"><span style="font-family:"Arial",sans-serif">www.uoguelph.ca/ccs</span></a><span style="font-family:"Arial",sans-serif;color:#1F497D"> | @UofGCCS on Instagram, Twitter and Facebook<o:p></o:p></span></p>
<p class="MsoNormal"><span style="font-family:"Arial",sans-serif"><o:p> </o:p></span></p>
<p class="MsoNormal"><img border="0" width="187" height="100" style="width:1.9479in;height:1.0416in" id="Picture_x0020_1" src="cid:image001.png@01D39B77.A184BA00" alt="University of Guelph Cornerstone with Improve Life tagline"><o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<p class="MsoNormal"><b>From:</b> bmeade90@gmail.com [mailto:bmeade90@gmail.com] <b>
On Behalf Of </b>Brian Meade<br>
<b>Sent:</b> Thursday, February 1, 2018 3:46 PM<br>
<b>To:</b> Lelio Fulgenzi <lelio@uoguelph.ca><br>
<b>Cc:</b> voyp list, cisco-voip (cisco-voip@puck.nether.net) <cisco-voip@puck.nether.net><br>
<b>Subject:</b> Re: [cisco-voip] anyone see audit log files fill up with a bunch of dbipphone entries?<o:p></o:p></p>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">Which audit log was it in?<o:p></o:p></p>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
<div>
<p class="MsoNormal">Only bugs I'm seeing are these 2:<o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtx70811">https://bst.cloudapps.cisco.com/bugsearch/bug/CSCtx70811</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><a href="https://bst.cloudapps.cisco.com/bugsearch/bug/CSCty20409">https://bst.cloudapps.cisco.com/bugsearch/bug/CSCty20409</a><o:p></o:p></p>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
<div>
<p class="MsoNormal"><o:p> </o:p></p>
<div>
<p class="MsoNormal">On Thu, Feb 1, 2018 at 3:24 PM, Lelio Fulgenzi <<a href="mailto:lelio@uoguelph.ca" target="_blank">lelio@uoguelph.ca</a>> wrote:<o:p></o:p></p>
<blockquote style="border:none;border-left:solid #CCCCCC 1.0pt;padding:0in 0in 0in 6.0pt;margin-left:4.8pt;margin-right:0in">
<p class="MsoNormal" style="margin-bottom:12.0pt"><br>
We ran into a condition where the audit log files on one of our nodes was filling up the log partition. Built in systems were deleting files appropriately, but the disk would just fill up again. Alerts started around 5:30 yesterday but I suspect the issue started
before that since it needed time to go from about 30% full (the norm) to 95% full. Files would be purged to about 80% full and need about 45 minutes to fill up.<br>
<br>
Turns out the logs were full of entries like this:<br>
<br>
ONLN|2018-02-01 09:11:45.000|nodeXYZ|28945|nodeXYZ_ccm9_1_2_11900_12|dbuser|0:RDRW:ccm9_1_2_11900_12:590:7342272:2244099<br>
ONLN|2018-02-01 09:11:45.000|nodeXYZ|28945|nodeXYZ_ccm9_1_2_11900_12|dbuser|0:RDRW:ccm9_1_2_11900_12:590:7342272:2244353<br>
ONLN|2018-02-01 09:11:45.000|nodeXYZ|28945|nodeXYZ_ccm9_1_2_11900_12|dbuser|0:RDRW:ccm9_1_2_11900_12:590:7342272:2244354<br>
ONLN|2018-02-01 09:11:45.000|nodeXYZ|28945|nodeXYZ_ccm9_1_2_11900_12|dbuser|0:RDRW:ccm9_1_2_11900_12:590:7342272:2244355<br>
ONLN|2018-02-01 09:11:45.000|nodeXYZ|28945|nodeXYZ_ccm9_1_2_11900_12|dbuser|0:RDRW:ccm9_1_2_11900_12:590:7342272:2244609<br>
<br>
Anyone seen anything like this before?<br>
<br>
It took a while to convince TAC that I wasn't looking to delete the files as my primary focus, but what was causing the files to be created. By that time, it stopped. Magically. At around 10:30.<br>
<br>
We're collecting logs, but just thought I'd ask.<br>
<br>
<br>
---<br>
Lelio Fulgenzi, B.A. | Senior Analyst<br>
Computing and Communications Services | University of Guelph<br>
Room 037 Animal Science & Nutrition Bldg | 50 Stone Rd E | Guelph, ON | N1G 2W1<br>
519-824-4120 Ext. 56354 | <a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a><mailto:<a href="mailto:lelio@uoguelph.ca">lelio@uoguelph.ca</a>><br>
<br>
<a href="http://www.uoguelph.ca/ccs" target="_blank">www.uoguelph.ca/ccs</a><<a href="http://www.uoguelph.ca/ccs" target="_blank">http://www.uoguelph.ca/ccs</a>> | @UofGCCS on Instagram, Twitter and Facebook<br>
<br>
[University of Guelph Cornerstone with Improve Life tagline]<br>
<br>
<br>
_______________________________________________<br>
cisco-voip mailing list<br>
<a href="mailto:cisco-voip@puck.nether.net">cisco-voip@puck.nether.net</a><br>
<a href="https://puck.nether.net/mailman/listinfo/cisco-voip" target="_blank">https://puck.nether.net/mailman/listinfo/cisco-voip</a><o:p></o:p></p>
</blockquote>
</div>
<p class="MsoNormal"><o:p> </o:p></p>
</div>
</div>
</body>
</html>