[Info-vax] Move SECURITY.AUDIT$JOURNAL off the system disk?

[Phillip Helbig---undress to reply]

In article <89gi37557klul1n8ahhn0cf366u1ua21fg at 4ax.com>, Joe Bloggs
<JBloggs at acme.com> writes: 

> >Is it possible to move SECURITY.AUDIT$JOURNAL off the system disk?  If 
> >so, a) is there any reason not to and b) where is this documented?
> 
> Try:
> 
> $! reply/enable/temp
> $  set audit/journal/destination=device:[dir]SECURITY.AUDIT$JOURNAL
> $  set audit/server=new_log
> $! reply/dis
> 
> May need stop/restart (i doubt it)
> 
> $ set audit/server=exit
> $ set audit/server=start

Thanks.  Another question is when it is originally opened.  It would be 
a good idea to issue the command above before anything is written to the 
log in the default location.

Similar for operator.log: a logical name can be used to set the name of 
the log file, but it would be good to do this before anything is written 
to the log file in the default location.

In both cases, is SYSLOGICALS.COM early enough?  

Is the order important?

> Can't think of any reason not to, except that 2 disks are more
> likely to fail, than 1 disk.  

I have SYSUAF etc off the system disk so that I have one common file.  I 
moved OPERATOR.LOG, ACCOUNTNG.DAT etc off the system disk to save space. 
Similar motivation for SECURITY.AUDIT$JOURNAL.

Should I have one per node or one common file?

> And depending on your audit policy, processes may be suspended 
> if disk space runs out on the audit journal's disk. 

Another reason to move it off the system disk.  :-)