Click here to monitor SSC
SQLServerCentral is supported by Red Gate Software Ltd.
 
Log in  ::  Register  ::  Not logged in
 
 
 
        
Home       Members    Calendar    Who's On


Add to briefcase 12345»»»

Need to zip and move C2 level audit files Expand / Collapse
Author
Message
Posted Thursday, September 16, 2010 6:17 AM
Old Hand

Old HandOld HandOld HandOld HandOld HandOld HandOld HandOld Hand

Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364, Visits: 683
We have a secure shop running SQL Server 2008 EE on a couple of Microsoft Failover Clusters (Windows Server 2008 EE). The data security folks want to implement C2 level auditing as we migrate from SQL Server 2005 to SQL Server 2008.

We have 8 databases online in our Production (high-intensity write) SQL Server 2008 environment at the moment, and we are getting swamped with 200 GB .trc files, which means that C2 level auditing is pretty much functioning as designed. :-(

I'm looking for ideas for how to zip up the old .trc files and move them to a different server for storage. Unfortunately, the audittrace*.trc files appear to be randomly named, based on a date stamp and what appears to be a sequential trace file number. At this point, I cannot tell which .trc files belong to which database, and I cannot tell (programatically) which files are open for write. (If the file is open for write, it cannot be deleted.)

Does anyone have experience with this in their shop?

Alternatively, is there a way to move the default location for the creation of the .trc files?



Post #987166
Posted Thursday, September 16, 2010 7:26 AM


SSCommitted

SSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommitted

Group: General Forum Members
Last Login: Yesterday @ 5:05 AM
Points: 1,618, Visits: 20,899
Since C2 audit trace files are created on the default data directory for SQL Server, you may change the Default Data directory

Pradeep Adiga
Blog: sqldbadiaries.com
Twitter: @pradeepadiga
Post #987233
Posted Thursday, September 16, 2010 10:52 AM
Old Hand

Old HandOld HandOld HandOld HandOld HandOld HandOld HandOld Hand

Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364, Visits: 683
Adiga (9/16/2010)
Since C2 audit trace files are created on the default data directory for SQL Server, you may change the Default Data directory


Actually, this part of the problem. The .trc files and the .mdf files are in the same directory. Can they be separated so that future .trc files go to a different disk?



Post #987460
Posted Thursday, September 16, 2010 1:04 PM


SSCommitted

SSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommittedSSCommitted

Group: General Forum Members
Last Login: Yesterday @ 5:05 AM
Points: 1,618, Visits: 20,899
As far as I know they cannot be separated.

Pradeep Adiga
Blog: sqldbadiaries.com
Twitter: @pradeepadiga
Post #987609
Posted Friday, September 17, 2010 7:02 AM
Old Hand

Old HandOld HandOld HandOld HandOld HandOld HandOld HandOld Hand

Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364, Visits: 683
In case anyone stumbles across this forum in the future, I thought I would add some information. I don't have a workaround yet, but here is what Microsoft says about how C2 level auditing works.

----------

1. Trace file is saved as <audittrace..Year..Month..Date...Timestamp hr:min:sec>

2. There is only 1 trace file per instance for all databases. There should be only 1 trace file (200mb) with the latest time stamp open for logging at any given time for particular instance.

3. C2 Log files always point to the default data files location of the instance. You cannot change the path of C2 audit files but you can change the location of default data location to some other drive. For changing the default path

right click on server->choose database setting change the database default locations to where you want to point the files

After SQL restart trace file will be created to the new default location provided in Database setting This will not change the existing database location. However you will need to make sure next time you create database point it to the right location

SQL server databases are not supported on compressed volume. As long as the availability of trace log directory can be achieved and databases are not put on compressed volume you should be able to point the trace file to compressed volume. I would recommend to test it in environment to ensure the availability of compressed volume because if the drive is not available to write to Trace log for any reason it can force to stop SQL service.



Post #988126
Posted Friday, September 17, 2010 7:16 AM


SSCrazy

SSCrazySSCrazySSCrazySSCrazySSCrazySSCrazySSCrazySSCrazy

Group: General Forum Members
Last Login: Thursday, May 02, 2013 2:32 AM
Points: 2,236, Visits: 3,620
shew (9/16/2010)
I'm looking for ideas for how to zip up the old .trc files and move them to a different server for storage. Unfortunately, the audittrace*.trc files appear to be randomly named, based on a date stamp and what appears to be a sequential trace file number. At this point, I cannot tell which .trc files belong to which database, and I cannot tell (programatically) which files are open for write. (If the file is open for write, it cannot be deleted.)


Coming back to this question, What i can think of is writing a script that pulls out all .trc file from the folder(where it is stored), sorts it by creation date/timestamp, zips all files one by one except the latest one. Schedule this script to run at an interval of few hours (change it based on your observation)

I had earlier written a vb script code that sorts the file...

dim TracePath

Set fso = CreateObject("Scripting.FileSystemObject")
Set folder = fso.GetFolder(Left(TracePath,len(TracePath)-1))
Set files = folder.Files

i=0
For each fileIdx In files
Redim Preserve allFiles(i)
Redim Preserve allTimeStamps(i)
allFiles(i)=fileIdx.Name
allTimeStamps(i)=fileIdx.DateLastModified
i=i+1
Next

'Now sort as per Modified TimeStamp
for i = lbound(allTimeStamps) to ubound(allTimeStamps)
for j = lbound(allTimeStamps) to ubound(allTimeStamps)
if allTimeStamps(i)<allTimeStamps(j) then
tt=allTimeStamps(i)
allTimeStamps(i)=allTimeStamps(j)
allTimeStamps(j)=tt
tt=allFiles(i)
allFiles(i)=allFiles(j)
allFiles(j)=tt
end if
next
next

for i = lbound(allFiles) to ubound(allFiles) -1 ' -1 so that we leave the latest file
' here you write Code to zip the file
' code to move the zipped file
Next


I modified the script a bit. havent tested it.






Pradeep Singh
Post #988144
Posted Friday, September 17, 2010 10:14 AM
Old Hand

Old HandOld HandOld HandOld HandOld HandOld HandOld HandOld Hand

Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364, Visits: 683
I started working on something similar with PowerShell (our preferred scripting language--our DBA team is not skilled in VB script), but, unfortunately, PowerShell calls the zip object asynchronously and the delete statement whacks some of the files before they flow through the "queue" for zipping. (This code is loosely based on http://blogs.msdn.com/b/daiken/archive/2007/02/12/compress-files-with-windows-powershell-then-package-a-windows-vista-sidebar-gadget.aspx .) The following is a "condensed version" and has not been fully tested. However, it shows that I am trying to do at this point.

$SourceFileSpecification_STR="L:\MSSQL10.instance_name\MSSQL\DATA\audittrace*.trc"
$DestinationZipFileSpecification_STR="my.zip"

get-childitem $SourceFileSpecification_STR | Where {$_.LastWriteTime -le "$LastWrite_DTE"}
$File_NMEs = get-childitem $SourceFileSpecification_STR | Where {$_.LastWriteTime -le "$LastWrite_DTE"}

<###############################################################
#
# Create empty .zip file
#
############################################+##################>

set-content $DestinationZipFileSpecification_STR ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))

(dir $DestinationZipFileSpecification_STR).IsReadOnly = $false

<###############################################################
#
# Zip and delete the files
#
############################################+##################>

$ShellApplication = new-object -com shell.application
$ZipPackage = $ShellApplication.NameSpace($DestinationZipFileSpecification_STR)

foreach ($File in $File_NMEs)
{
<###############################################################
#
# Display file information
#
############################################+##################>

write-host "Current file: $File; Length=$File.Length"

dir $File

<###############################################################
#
# Compress the file
#
############################################+##################>

$PotentialFailureReason_DSC = "Error compressing $File"

$ZipPackage.CopyHere($File.FullName)
if (!$?) {job_failure}

Start-sleep -milliseconds 9000

<###############################################################
#
# Delete the original file--note that open files will fail on
# the delete, which is what you want it to do
#
############################################+##################>

del $file
# if (!$?) {job_failure}
}



Post #988365
Posted Friday, September 17, 2010 10:44 AM


SSCrazy

SSCrazySSCrazySSCrazySSCrazySSCrazySSCrazySSCrazySSCrazy

Group: General Forum Members
Last Login: Thursday, May 02, 2013 2:32 AM
Points: 2,236, Visits: 3,620
in fact its good to have it written in powershell :)
I suppose vbscript would have faced the same issue - of zipping asynchrous.

may be you can write the move part in a seperate job that moves all zipped files. and run this "before" the the zipping job runs.





Pradeep Singh
Post #988401
Posted Saturday, September 18, 2010 4:22 PM


SSC-Dedicated

SSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-DedicatedSSC-Dedicated

Group: General Forum Members
Last Login: Today @ 2:32 PM
Points: 32,906, Visits: 26,792
Can't you just write a batch file loop for this?

--Jeff Moden
"RBAR is pronounced "ree-bar" and is a "Modenism" for "Row-By-Agonizing-Row".

First step towards the paradigm shift of writing Set Based code:
Stop thinking about what you want to do to a row... think, instead, of what you want to do to a column."

For better, quicker answers on T-SQL questions, click on the following...
http://www.sqlservercentral.com/articles/Best+Practices/61537/

For better answers on performance questions, click on the following...
http://www.sqlservercentral.com/articles/SQLServerCentral/66909/
Post #988797
Posted Saturday, September 18, 2010 7:58 PM
Old Hand

Old HandOld HandOld HandOld HandOld HandOld HandOld HandOld Hand

Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364, Visits: 683
Jeff Moden (9/18/2010)
Can't you just write a batch file loop for this?


That would be great. Please post code for what you have in mind.



Post #988830
« Prev Topic | Next Topic »

Add to briefcase 12345»»»

Permissions Expand / Collapse