Copying audit logs from the failed primary Admin Node

If you are able to copy audit logs from the failed primary Admin Node, you should preserve them to maintain the grid's record of system activity and usage. You can restore the preserved audit logs to the recovery primary Admin Node after it is up and running.

About this task

This procedure copies the audit log files from the failed Admin Node to a temporary location on a separate grid node. These preserved audit logs can then be copied to the replacement Admin Node. Audit logs are not automatically copied to the new Admin Node.

Depending on the failure of the Admin Node, it might not be possible to copy audit logs from the failed Admin Node. In a deployment with more than one Admin Node, audit logs are replicated to all Admin Nodes. Thus, in a multi‐Admin Node deployment, if audit logs cannot be copied off of the failed Admin Node, audit logs can be recovered from another Admin Node in the system. In a deployment with only one Admin Node, where the audit log cannot be copied off of the failed Admin Node, the recovered Admin Node starts recording events to the audit log in a new empty file and previously recorded data is lost.

Note: If the audit logs are not accessible on the failed Admin Node now, it is possible that you will be able to access them later, for example, after host recovery.

Steps

From the service laptop, log in to an Admin Node. If possible, log in to the failed Admin Node. If the failure is such that you cannot log in to the failed Admin Node, log in to the primary Admin Node or another Admin Node, if available.
1. Enter the following command: ssh admin@Admin_Node_IP
2. Enter the password listed in the Passwords.txt file.
3. Enter the following command to switch to root: su -
4. Enter the password listed in the Passwords.txt file.
Once logged in as root, the prompt changes from $ to #.
Stop the AMS service to prevent it from creating a new log file:/etc/init.d/ams stop
Rename the audit.log file so that it does not overwrite the file on the recovered Admin Node when you copy it to the recovered Admin Node.
Rename audit.log to a unique numbered file name such as YYYY-MM-DD.txt.1. For example, you can rename the audit.log file to 2015-10-25.txt.1cd /var/local/audit/exportls -lmv audit.log 2015-10-25.txt.1
Restart the AMS service: /etc/init.d/ams start
Create the directory to copy all audit log files to a temporary location on a separate grid node: ssh admin@grid_node_IP mkdir -p /var/local/tmp/saved-audit-logs
When prompted, enter the password for admin.
Copy all audit log files: scp -p * admin@grid_node_IP:/var/local/tmp/saved-audit-logs
When prompted, enter the password for admin.
Log out as root: exit