Get a Free 30 Day Evaluation of Kanaka for Mac!

The Admin tool allows you to specify at what times of the day it should sort data files.

(Click on Image to Expand)

There is one auditing file kept per day. It's name is of the form YYYYMMDD.00x where x is either 0 or 1. The distinction is:

• .001 files have had data written to them by the consolidator since the last sort took place.
• .000 files have had no data written to them by the consolidator since the last sort took place. 

Normally, data is sent in by the system monitoring NLM as the events occur on that server. However, if the consolidator is down or is otherwise unreachable due to network or server problems, the data is staged on the server running the system monitoring NLM. When the server detects that the consolidation NLM is reachable, all data in the staging file is sent in. This means that the data in the auditing files can be in an unsorted state.

At the times specified, the consolidator will look for all .001 files and sort them; renaming each to .000 after sorting it. The sort is based on the quicksort algorithm and does not require that the entire file be in memory during the sort process. It uses intermediary files to ease memory allocation requirements for files with more than 10,000 records.

If you have more than 10,000 login/logout records per day, you should consider marking the AUDITLOG directory as Immediate Purge.