Having problems with your account or logging in?
A lot of changes are happening in the community right now. Some may affect you. READ MORE HERE
Highlighted
PerthRM8 Outstanding Contributor.
Outstanding Contributor.
307 views

Audit events for: Document viewed - How many had setup this? Implications?

Hi,

Win 10, HPE RM 8.3 Patch 2 (9231) OFFICE 2016, SQL 2012-R2 , testing MF CM9.3.1.300 , SQL 2016-R2

OK, we have around 3000 TRIM users and 60 WGS accross the state , never had these "document viewed" audit event logs .. (ITSD has advised us when we had TRIM 7.34 that if we enable these logs every time the TRIM document is viewed / previewed that will stuff up the system , events log server , it will be big backlog etc....

We also have a Intranet page where a lots of pictures from TRIM are used as the icons or for other business purposes (50 or so would be loaded on the single page viewed) plus links to other docs in TRIM, so if the user view this intranet page the system will register hundreds of these event logs as "document viewed" ...

In our DEV / TST 9.3.1.300 environment i have enabled these event (in a record type settings and in Administration - Audits) and it looks OK to me (I am the only user) ...

I am asking what is your experiences regarding turning this option on?

What are the implications on:

  • Amount of the logs / historical event logs in TRIM Database
  • The amount of “cached” documents on user’s PC folder
  • The amount of “cached” documents on WGS Servers folder “TRIM Cache”
  • Slowness of the system in: SQL Database, WGS (Audit Server) and off course the TRIM STORE(s)
  • The network bandwidth affected?
  • CPU Usages on: WGS, SQL Server, TRIM DATA STORES
  • Searches?
  • Data maintenance / Audit logs maintenance, how long it is kept
  • General slownes of the system ....?

Anything else ...

Any good comments would be much appreciated.

Perth 38 C in plus.

 

 

 

0 Likes
3 Replies
Micro Focus Expert
Micro Focus Expert

Re: Audit events for: Document viewed - How many had setup this? Implications?

It will come down to how much hardware you are prepared to allocate to your setup, if you have a couple of WGS and plenty of storage then you will likely never see an issue with enabling more in the Audit logs.

Client side should not see any performance change, the majority is server side.
If you do see performance server side separating the WGS so that you have one (or more for large sites) that handles client connections. Then have another that will deal with the indexing and audit logs.

It will be dependent on the volume or searches, that is what typically will add up to performance degradation. This can be improved by allocating enough hardware to deal with it.

**Any opinions expressed in this forum are my own personal opinion and should not be interpreted as an official statement on behalf of Micro Focus**
JanMartin Outstanding Contributor.
Outstanding Contributor.

Re: Audit events for: Document viewed - How many had setup this? Implications?

There are two kinds of audit logs, online and offline - online audit logs are stored in a SQL table whereas offline audit logs are stored in a text document as records in TRIM.

Enabling online audit logs in a large environment does have implications on database performance, particularly there will be a large number of INSERTs to the TSONLINEAU table. This may not necessarily affect things like Record searching because by default TSONLINEAU is not accessed as part of object searches.

However, if users are frequently attempting to do complex search in the online audit log there may be general SQL performance degredation. Over time, the online audit log will inevitably grow to be the largest table in the database.

Offline audit logs do not have the same effect on the SQL database, however they do create more writes to disk. I think by default each offline audit log record is capped at 20Mb and then another record is created. This helps reduce the impact on SQL performance but at the cost of usability. If your users want to interrogate an audit log they have no choice but to extract the records and perform manual inspection or export them into a third party tool to do analysis.

If your users are not likely to want to look through the audit logs very often I would go with offline audit logs.

We also have a Intranet page where a lots of pictures from TRIM are used as the icons or for other business purposes (50 or so would be loaded on the single page viewed) plus links to other docs in TRIM, so if the user view this intranet page the system will register hundreds of these event logs as "document viewed" ...

Are these being extracted straight out of TRIM through a webservice? I would say this is strongly recommended against, and instead you should be publishing the images when they are updated. The links will not generate audit logs when they are generated, only when they are clicked on.

0 Likes
PerthRM8 Outstanding Contributor.
Outstanding Contributor.

Re: Audit events for: Document viewed - How many had setup this? Implications?

Thanks Greg and Jan , much appreciated:

Greg: We do have a separate server for web, for WGS, for IDOL, for Audits, Mail notifications etc, but we are still concerned that the whole system overall will be under much bigger burden if we turn these events / audit logs ON; The SQL database especially will be affected if I understand correctly;

Jan: thanks for the detailed explanations and making clear in my mind about these  2 different types of audit logs; we do have both of them ON currently, so I am not sure how we can make the one in SQL smaller and the one that goes offline to 20MB chunk of logs bigger one (more detailed) as these audit events logs (Document viewed)  are setup on the Record type, right?

BTW, we are using a third party TRIM app SIGMA Logs in TRIM (app and web version) for the interrogation of these offline logs already)

But in general, it looks like that all this "document viewed" issue is NO GO zone so , most likely i will recommend that this event not to be logged either in online or in offline logs...

If anyone can prove me wrong..please do so.

Thanks

 

 

 

 

0 Likes
The opinions expressed above are the personal opinions of the authors, not of Micro Focus. By using this site, you accept the Terms of Use and Rules of Participation. Certain versions of content ("Material") accessible here may contain branding from Hewlett-Packard Company (now HP Inc.) and Hewlett Packard Enterprise Company. As of September 1, 2017, the Material is now offered by Micro Focus, a separately owned and operated company. Any reference to the HP and Hewlett Packard Enterprise/HPE marks is historical in nature, and the HP and Hewlett Packard Enterprise/HPE marks are the property of their respective owners.