Safely Enabling Auditing on VA

[titan31]

Hi,

I'm looking to re-enable auditing on our VA server, and working out the best way to do this without causing performance issues or the server crashing (this happened last time as the VA Audit entry tables in postgres grew too big).

I've been reading a bunch of documentation on it and what to do, as I feel like last time it was settings that caused issues, and I'm thinking the following is the correct path. If anyone suggests something different, let me know.

1. Purge everything from SASAudit and SASAuditArchive

2. Change the Archiving rules from monthly to weekly in Audit_archive_rule through pgAdmin

3. Change the jvm options for how often the audit archive runs from weekly to daily (Where do I do this btw)

4.On the autoload host, start the scheduled task that deletes old records from the full AUDIT_VISUALANALYTICS table

5. Set the property va.AuditingEnabled to true

6. Restart server

7. Monitor the hell out of it, and manually purge the tables. Plan is to run it for one week once a month and purge after the week once I've got the information I'm looking for.

Few questions though that I can't find in documentation.

1. Where do I change the jvm options for changing the archiving to happen from weekly to daily. Only thing I can in documentation is

To control the archive job schedule, you can add a JVM option to SAS Web Application Server

but is that on 1_1,2_1 etc on the middle tier server, or just one of them. I couldn't find the -Dsas.audit.archive.cron already specified so not sure what to do here.

2. Is there a way to limit what actions are audited (show what reports are viewed for example instead of when everyone logs on and off), or is that just at default and can't change.

Thanks,

Craig

[JuanS_OCS]

Hello @titan31,

could we know the current SAS VA version you have, and the hotfix level?

Newer versions do manage better audit data and processes.

Thank you in advance,

Kind regards,

Juan

[titan31]

Hi,

The VA version is 7.4, and I'm not sure on the hotfix level, but the build date is November 2, 2017 if that helps. We reinstalled back in December and hotfixes haven't been applied since then.

On the about for VA Designer, it says Version is 7.4 Hotfix 05 if that helps.

Thanks,

Craig

[JuanS_OCS]

@titan31,

http://support.sas.com/kb/58/599.html and https://blogs.sas.com/content/sgf/2015/11/09/controlling-the-size-of-the-web-infrastructure-platform...

For the rest, you are right in general. The web application server modification, would it be only in SASServer1_1 (unless you have a cluster), since here is where the WIP is located.

For your last question, please see http://go.documentation.sas.com/api/docsets/bimtag/9.4/content/bimtag.pdf (see Configuring Auditing for SAS Web Applications)