3 Replies Latest reply: Dec 17, 2014 9:23 PM by Kent Liao RSS

    Governance Dashboard read more than 100M size of audit log

    Kent Liao

      Dear Community:

       

      I use Governance Dashboard 1.1 On QV Server 11.2 SR9 and has it more than 1 month, Recently ,I find a Strange situation.

      When audit log (Split filters per day) size is more than 100M, The Governance Dashboard reload job will be fail. I try to cut the Audit log size less than 100M, then reload job is fine and work.

      Is it normal or I need to do some setup ?

       

      Thanks in advance for any help

        • Re: Governance Dashboard read more than 100M size of audit log
          Rob Wunderlich

          Can you post any specific error messages you are receiving?

          • Re: Governance Dashboard read more than 100M size of audit log
            Tyler Waterfall

            kent,

            This is likely due to an excessively large audit record from when a user made a selection of many values in a specific field.

            If you look at the bottom of the fullscan.messages.log file (in the profiles\default\QVX_LastRun folder), you will likely see something like the following.  (Note that the -F entries signify failures.)

             

            Multi-Transform Audit Log - OPERATOR-0016-F: toolId 219.0, name 'Multi-Transform Audit Log' - Exception 'BufferAllocatorException' occurred in the 'process' function for thread 0. (FullScan.Step_1)

            Multi-Transform Audit Log - OUTPUT_BUFFER-0005-A: An output record is too large. The hard limit on output buffer size of 33,554,432 bytes has been exceeded by a request for 66,322,432 bytes. (FullScan.Step_1)

            Multi-Transform Audit Log - OPERATOR-0005-F: toolId 219.0, name 'Multi-Transform Audit Log' - the 'process' function failed for thread 0. (FullScan.Step_1)

             

             

            If this is the case, the fix is to find that large Audit log file, open it and find the huge entry and remove it.  One way to search for it is to manually look at the log file (with word wrap on). Or, you could load all the audit log files into QlikView with something like the attached, and search for the long entries.

             

            screen.png