SASWIPClientAccess9.4.log occupying more space

[maheshtalla]

Hi Admins,

 On our Mid-tier server the SASWIPClientAccess9.4.log is occupying about 40GB. Do some one have any recommendation how to deal with that. IS that fine if I can delete that file? I don't see any error but concerns is Config folder is full due to that log file. Please suggest.

path of the file is /sso/biconfig/940/Lev1/Web/Logs/SASServer1_1/SASWIPClientAccess9.4.log

Thanks in advance.

[Kurt_Bremser]

I would:

• stop the Web Application Server, and make sure that no tomcat instance is left running
• move the file to another place
• start the Web Application Server

Note that stopping/starting the WAS takes quite some time, so get some scheduled downtime for that (unless your situation is already critical and services have stopped working)

After that, inspect the file. Start at the end to see if some rapidly repeating pattern caused the size increase. If not, you might contemplate to use SAS to read the log and do statistical analyses to see if a lot of messages were written within a rather short timeframe.

You might find that it was caused by someone trying some kind of brute force attack (intentional or unintentional). This can happen when penetration tests are run by security people.