|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364,
Visits: 683
|
|
We have a secure shop running SQL Server 2008 EE on a couple of Microsoft Failover Clusters (Windows Server 2008 EE). The data security folks want to implement C2 level auditing as we migrate from SQL Server 2005 to SQL Server 2008.
We have 8 databases online in our Production (high-intensity write) SQL Server 2008 environment at the moment, and we are getting swamped with 200 GB .trc files, which means that C2 level auditing is pretty much functioning as designed. :-(
I'm looking for ideas for how to zip up the old .trc files and move them to a different server for storage. Unfortunately, the audittrace*.trc files appear to be randomly named, based on a date stamp and what appears to be a sequential trace file number. At this point, I cannot tell which .trc files belong to which database, and I cannot tell (programatically) which files are open for write. (If the file is open for write, it cannot be deleted.)
Does anyone have experience with this in their shop?
Alternatively, is there a way to move the default location for the creation of the .trc files?
|
|
|
|
|
SSCommitted
      
Group: General Forum Members
Last Login: Yesterday @ 5:05 AM
Points: 1,618,
Visits: 20,899
|
|
Since C2 audit trace files are created on the default data directory for SQL Server, you may change the Default Data directory
Pradeep Adiga Blog: sqldbadiaries.com Twitter: @pradeepadiga
|
|
|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364,
Visits: 683
|
|
Adiga (9/16/2010) Since C2 audit trace files are created on the default data directory for SQL Server, you may change the Default Data directory
Actually, this part of the problem. The .trc files and the .mdf files are in the same directory. Can they be separated so that future .trc files go to a different disk?
|
|
|
|
|
SSCommitted
      
Group: General Forum Members
Last Login: Yesterday @ 5:05 AM
Points: 1,618,
Visits: 20,899
|
|
|
|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364,
Visits: 683
|
|
In case anyone stumbles across this forum in the future, I thought I would add some information. I don't have a workaround yet, but here is what Microsoft says about how C2 level auditing works.
----------
1. Trace file is saved as <audittrace..Year..Month..Date...Timestamp hr:min:sec>
2. There is only 1 trace file per instance for all databases. There should be only 1 trace file (200mb) with the latest time stamp open for logging at any given time for particular instance.
3. C2 Log files always point to the default data files location of the instance. You cannot change the path of C2 audit files but you can change the location of default data location to some other drive. For changing the default path
right click on server->choose database setting change the database default locations to where you want to point the files
After SQL restart trace file will be created to the new default location provided in Database setting This will not change the existing database location. However you will need to make sure next time you create database point it to the right location
SQL server databases are not supported on compressed volume. As long as the availability of trace log directory can be achieved and databases are not put on compressed volume you should be able to point the trace file to compressed volume. I would recommend to test it in environment to ensure the availability of compressed volume because if the drive is not available to write to Trace log for any reason it can force to stop SQL service.
|
|
|
|
|
SSCrazy
      
Group: General Forum Members
Last Login: Thursday, May 02, 2013 2:32 AM
Points: 2,236,
Visits: 3,620
|
|
shew (9/16/2010) I'm looking for ideas for how to zip up the old .trc files and move them to a different server for storage. Unfortunately, the audittrace*.trc files appear to be randomly named, based on a date stamp and what appears to be a sequential trace file number. At this point, I cannot tell which .trc files belong to which database, and I cannot tell (programatically) which files are open for write. (If the file is open for write, it cannot be deleted.)
Coming back to this question, What i can think of is writing a script that pulls out all .trc file from the folder(where it is stored), sorts it by creation date/timestamp, zips all files one by one except the latest one. Schedule this script to run at an interval of few hours (change it based on your observation)
I had earlier written a vb script code that sorts the file...
dim TracePath
Set fso = CreateObject("Scripting.FileSystemObject") Set folder = fso.GetFolder(Left(TracePath,len(TracePath)-1)) Set files = folder.Files
i=0 For each fileIdx In files Redim Preserve allFiles(i) Redim Preserve allTimeStamps(i) allFiles(i)=fileIdx.Name allTimeStamps(i)=fileIdx.DateLastModified i=i+1 Next
'Now sort as per Modified TimeStamp for i = lbound(allTimeStamps) to ubound(allTimeStamps) for j = lbound(allTimeStamps) to ubound(allTimeStamps) if allTimeStamps(i)<allTimeStamps(j) then tt=allTimeStamps(i) allTimeStamps(i)=allTimeStamps(j) allTimeStamps(j)=tt tt=allFiles(i) allFiles(i)=allFiles(j) allFiles(j)=tt end if next next
for i = lbound(allFiles) to ubound(allFiles) -1 ' -1 so that we leave the latest file ' here you write Code to zip the file ' code to move the zipped file Next
I modified the script a bit. havent tested it.
Pradeep Singh
|
|
|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364,
Visits: 683
|
|
I started working on something similar with PowerShell (our preferred scripting language--our DBA team is not skilled in VB script), but, unfortunately, PowerShell calls the zip object asynchronously and the delete statement whacks some of the files before they flow through the "queue" for zipping. (This code is loosely based on http://blogs.msdn.com/b/daiken/archive/2007/02/12/compress-files-with-windows-powershell-then-package-a-windows-vista-sidebar-gadget.aspx .) The following is a "condensed version" and has not been fully tested. However, it shows that I am trying to do at this point.
$SourceFileSpecification_STR="L:\MSSQL10.instance_name\MSSQL\DATA\audittrace*.trc" $DestinationZipFileSpecification_STR="my.zip"
get-childitem $SourceFileSpecification_STR | Where {$_.LastWriteTime -le "$LastWrite_DTE"} $File_NMEs = get-childitem $SourceFileSpecification_STR | Where {$_.LastWriteTime -le "$LastWrite_DTE"}
<############################################################### # # Create empty .zip file # ############################################+##################>
set-content $DestinationZipFileSpecification_STR ("PK" + [char]5 + [char]6 + ("$([char]0)" * 18))
(dir $DestinationZipFileSpecification_STR).IsReadOnly = $false
<############################################################### # # Zip and delete the files # ############################################+##################>
$ShellApplication = new-object -com shell.application $ZipPackage = $ShellApplication.NameSpace($DestinationZipFileSpecification_STR)
foreach ($File in $File_NMEs) { <############################################################### # # Display file information # ############################################+##################>
write-host "Current file: $File; Length=$File.Length"
dir $File
<############################################################### # # Compress the file # ############################################+##################>
$PotentialFailureReason_DSC = "Error compressing $File"
$ZipPackage.CopyHere($File.FullName) if (!$?) {job_failure}
Start-sleep -milliseconds 9000
<############################################################### # # Delete the original file--note that open files will fail on # the delete, which is what you want it to do # ############################################+##################>
del $file # if (!$?) {job_failure} }
|
|
|
|
|
SSCrazy
      
Group: General Forum Members
Last Login: Thursday, May 02, 2013 2:32 AM
Points: 2,236,
Visits: 3,620
|
|
in fact its good to have it written in powershell :) I suppose vbscript would have faced the same issue - of zipping asynchrous.
may be you can write the move part in a seperate job that moves all zipped files. and run this "before" the the zipping job runs.
Pradeep Singh
|
|
|
|
|
SSC-Dedicated
           
Group: General Forum Members
Last Login: Today @ 2:32 PM
Points: 32,906,
Visits: 26,792
|
|
|
|
|
|
Old Hand
      
Group: General Forum Members
Last Login: Thursday, May 09, 2013 4:51 PM
Points: 364,
Visits: 683
|
|
Jeff Moden (9/18/2010) Can't you just write a batch file loop for this?
That would be great. Please post code for what you have in mind.
|
|
|
|