Return
-
Title
Issues with data growth in /var/InTrust directory on Solaris or Linux machines running InTrust ag -
Description
Issues with data growth in /var/InTrust directory on Solaris or Linux machines running InTrust agent. When running the Quest InTrust agent on a Linux or Solaris machine to collect or monitor syslog data you notice a large number of files occupying a lot of space in the /var/InTrust directory. -
Cause
This occurs because the agent creates a cached copy of the syslog data in /var/InTrust so that it can read this data during gathering. By default the Syslog Data Source keeps 8 days worth of this data -
Resolution
1. Open InTrust Manager
2. Expand Configuration | Data Sources
3. Right click on Solaris Syslog or Redhat Linux Syslog choose Properties and then change the value for the 'Agent side audit ..' to a smaller number
4. Click OK and then click the blue check mark to commit changes. -
Additional Information
This affects all versions of InTrust (not InTrust Express or InTrust for Events though)