Using the Auditing Subscription Logging (SLOG) Facility

This section describes how to use the subscription logging facility, or SLOG facility, to ensure that auditing data sent to specific destinations is not lost if problems occur on these destinations. The SLOG facility is not automated, so it must be activated for those destinations before you start using it.

Once activated, when a destination becomes unavailable, the SLOG facility performs subscription logging by writing the auditing data to an Adabas Audit Server system file called the SLOG system file. The moment the destination is reopened and available, the SLOG facility starts sending the auditing data it recorded back to the destination, while continuing to record new auditing data sent to that destination. When the destination logging catches up with the current auditing data being processed, normal auditing processing resumes. This means that when all of the auditing data written to the SLOG system file has been successfully sent to the destination, the Adabas Audit Server will stop logging data to the SLOG system file for the destination and recommence sending it directly to the destination.

Notes:

  1. Subscription logging is resource intensive and should only be used where necessary.
  2. If a destination is unavailable for a significant amount of time, a large volume of data can be generated and written to the SLOG system file.
  3. The single point of failure for the SLOG facility is that if the SLOG system file is not large enough to contain the auditing data that must be logged, the SLOG facility fails, and auditing data will subsequently be lost.

The following subsections cover the topics:


Setting Up Subscription Logging

Setting up subscription logging requires the following steps:

Step 1. Calculate the maximum amount of space required

The installation requires an estimate of the amount of space that will be dedicated to the SLOG system file. The data that is written to the SLOG file are the UAB* control blocks and associated auditing data. Therefore, the most appropriate mechanism for determining how much data will be written is to monitor the amount of data written to a specific destination during normal processing.

Start of instruction setTo calculate the maximum amount of space follow these substeps:

  1. Determine the maximum amount of time that a destination may be unavailable. This may be related to maintenance windows, service level agreements, or other factors.

  2. Determine the amount of data that is sent to the destination during its highest level of activity.

  3. Based on the figures from these substeps 1 and 2, calculate the amount of data that will be written to a destination, assuming maximum outage time during the highest level of activity.

  4. Add a 50% contingency and use the result to calculate the space required in the SLOG system file for the destination.

  5. Repeat substeps 1 through 4 for each destination where the SLOG facility will be activated.

    If multiple destinations are associated with the same subscription and if the destinations are only written to from that one particular subscription, then only one destination should be included in the calculation, as the SLOG facility can optimize the recording of data.

  6. Based on the total space requirements for all destinations for which the SLOG facility will be activated, establish a space requirement for the SLOG system file and verify that the Adabas Audit Server is large enough to contain it.

Step 2. Define the SLOG system file

Using the space calculation from Step 1, use the sample job ADALODSL to define the SLOG system file to the Adabas Audit Server. Ensure all blank parameters in the sample job are correctly set. Sample job ADALODSL is supplied in member ADALODSL of the MVSJOBS data set.

Step 3. Activate subscription logging for the appropriate destinations

Review the destination definitions for the destinations for which you want subscription logging and activate it using the Allow Logging field in Maintaining Destination Definitions within the Adabas Auditing Configuration.

Step 4. Restart the Adabas Audit Server

Restart the Adabas Audit Server with the modified destination definitions.

Starting Subscription Logging

Once subscription logging has been activated for a destination, it will automatically occur if:

  • An unrecoverable error occurs on the destination.

  • The destination becomes full.

Stopping Subscription Logging

Once subscription logging is started for a destination, it will automatically stop when the destination becomes available again and all logged audit data is delogged from the SLOG system file to the destination.

Delogging Subscription Logging File Data

Delogging is the process of reading the logged audit data for a destination in the SLOG system file and sending it to the destination. For destinations with activated subscription logging and for which data has been logged, delogging will occur automatically once the destination becomes full, provided that a full condition is expected to clear itself.

Deleting Subscription Logging System File Data

Logged audit data is deleted from the SLOG system file when:

  • The audit data has been delogged and successfully sent to the destination.

  • The destination is deactivated.

  • The audit data is logged for a destination and the Adabas Audit Server address space has been terminated. When the Adabas Audit Server is subsequently restarted and if the data exists in the SLOG system file for a destination that no longer exists or for which subscription logging has been deactivated, all SLOG system file data for that destination is deleted.

Note:
In cases where multiple destinations with active subscription logging are being logged to form a single subscription, the physical data in the SLOG system file will only be deleted when it has been sent to all destinations which have experienced a failure. This is due to an optimization in the Adabas Audit Server.

Maintaining the Subscription Logging System File

The SLOG system file must be maintained in the same manner as any other system file. The SLOG system file may be deleted, reloaded, saved, restored, refreshed, or reordered. For more information about Adabas system files and utilities, refer to your Adabas Utilities documentation.

Error Conditions for the Subscription Logging Facility

The only error condition expected for the SLOG facility is if the SLOG system file becomes full. When this happens, the destination with the largest number of items on the SLOG system file is identified and deactivated. Note that all SLOG system file data for this destination will be deleted, resulting in data loss for this destination.

In the event of any other error, the SLOG facility will deactivate the destination where the failure occurred. This will result in all SLOG system file data for that destination being deleted, resulting in data loss for that destination.