TM1.Audit.PostProcessor Failed to open audit store ...

[EvgenyT]

Hi Guys,

A quick question for you:

I have turned on AuditLogOn = T on my TM1 model to trace changes performed by users. With following parameters in tm1s.cfg file:

AuditLogOn=T
AuditLogUpdateInterval = 60
AuditLogMaxFileSize=20 MB
TempFileSize= 20mb
RawStoreDirectory = AuditLogs

When I came back following morning I found my logs directory filled with tm1server.log.1, tm1server.log.2 etc (about dozen of them) files. Each file no less than 100 mb in size. I opened up the file and found numerous lines of errors:

852 [] ERROR 2013-08-23 08:08:58.390 TM1.Audit.PostProcessor Failed to open audit store in AppendRawStoreToAuditStore


Also RAM on the box was going through the roof at almost 99% (there is 40 GB on the box).

Model is running on TM1 10.1.1

I have searched all over the net and IBM resources, but haven't been able to find an answer.

Does any one have a clue what is going on here?


Thanks guys!

ET

[lotsaram]

Hi ET - is that tm1s.cfg code exactly as in the system with "RawStoreDirectory = AuditLogs" ? As far as I'm aware the directory parameters require a full local file path or UNC path, with or without trailing backslash. DistributedPlanningOutputDir can cope with ./<folder> but I don't see why RawStoreDirectory if specified would be different than DataDirectory or LoggingDirectory in the input it requires.

So how is the server supposed to interpret the location of "AuditLogs"? As in maybe the problem is that as opposed to "unable to open audit store" as per the error log message the real problem is that the server has no idea where to look in the first place?

[EvgenyT]

Hi Lotsaram,

Thanks for you reply. See folder structure attached.

As you can see TM1s.cfg sits outside data, logs and audit logs folders.

So how is the server supposed to interpret the location of "AuditLogs"? As in maybe the problem is that as opposed to "unable to open audit store" as per the error log message the real problem is that the server has no idea where to look in the first place?

It funny you say that because, TM1 doesnt seem to have a problem writing encrypted tracing record to Audit Logs folder (for e.g. changes made to Customer Dimension, file: Customer.dim.20130825230135)... and I can "View Audit Logs" via TM1..

I will provide a full UNC path in TM1s.cfg and see if the error goes away...

ET

[EvgenyT]

Hi Matie,

Think you must have been right... I specified full UNC path in my tm1.cfg file and the problem have not appeared since.

The trend seems to be that rawstore files have no problem being written to AuditLog folder (without specifying full UNC), but when tm1auditstore....log tries to retrieve those changes it gets confused.

Anyhow, UNC seemed to solve the problem

Thanks

ET

[RJ!]

We seem to have a similar issue, do you have to restart the service after changing the cfg file?

[Michel Zijlema]

We seem to have a similar issue, do you have to restart the service after changing the cfg file?

No, based on the TM1 Documentation:

RawStoreDirectory

Indicates the location of the temporary, unprocessed log file for audit logging if logging takes place in a directory other than the data directory.

Parameter type:

Optional

Dynamic

Modified parameter values are applied to the server when you save the Tm1s.cfg file. There is no need to restart the server.

If this parameter is not entered, by default the unprocessed audit log file is saved in the directory listed in the DataBaseDirectory parameter.

Michel

[AmbPin]

Hello thanks for this, was having a similar problem myself so have changed to a UNC path and will see what happens.

Could anyone point me in the direction of some reference material on rawstore files, or in particular let me know if/when it is safe to delete them?

Thanks