Optimizing system performance while auditing

Enabling auditing should have minimal effect on the performance of Crystal Enterprise. However, you can optimize system performance by fine-tuning these command-line options:

• -AuditInterval minutes, where minutes is between 1 and 15. (The default value is 5.) The CMS requests audit records from each audited server every audit interval.
• -AuditBatchSize number, where number is between 50 and 500. (The default value is 200.) The CMS requests this fixed number of records from each audited server, every time interval.
• -auditMaxEventsPerFile number (number has a default value of 500 and must be greater than 0). The maximum number of records that an audited server will store in a single audit log file. When this maximum value is exceeded, the server opens a new log file.

Note:    Log files remain on the audited server until all records have been requested by the CMS.

Changing each of these options has a different impact on system performance. For example, increasing the audit interval reduces frequency with which the CMS writes events to the auditing database. Decreasing the audit batch size decreases the rate at which records are moved from the audit log files on the audited servers to the auditing database, thereby increasing the length of time that it takes these records to get transferred to the central auditing database. Increasing the maximum number of audit events stored in each audit log file reduces the number of file open and close operations performed by audited servers.

You can use these options to optimize audit performance to meet your needs. For example, if you frequently need up-to-date information about audited actions, you can choose a short audit interval and a large audit batch size. In this case, all audit records are quickly transferred to the auditing database, and you can always report accurately on the latest audit actions. However, choosing these options may have an impact on the performance of Crystal Enterprise.

Alternatively, you may only need to review audit results periodically (weekly, for example). In this case you can choose to increase the audit interval, and to decrease the number of audit records in each batch. Choosing these options minimizes the impact that auditing has on the performance of Crystal Enterprise. However, depending upon activity levels in your system, these options can create a backlog of records stored in audit log files. This backlog is cleared at times of low system activity (such as overnight, or over a weekend), but means that at times your audit reports may not contain records of the most recent audit actions.

Related topics

• Server Command Lines