If you have enabled automatic saves based on the size of the internal log file, you can specify the size threshold.
The default size threshold for the internal log file is 75 percent, so that whenever the internal log file is 75 percent full, the contents are automatically saved to the external event file. You can specify the threshold as a percentage of the size of the internal log file or as an absolute size.
The following table shows the units of measure and values you can use to specify the size threshold of the internal log file for automatic saves.
Units of measure | Values |
---|---|
% (percentage of the cifsaudit.alf file) | 1 to 100 |
k (kilobytes) | 1 to 67108864 |
m (megabytes) | 1 to 65526 |
g (gigabytes) | 1 to 64 |
If you want to... | Then... |
---|---|
Specify the size threshold at which the internal log file is automatically saved | Enter the following command: options cifs.audit.autosave.onsize.threshold Nsuffix N is the value of the size threshold. suffix is the unit of measure. Example: options cifs.audit.autosave.onsize.threshold 90% |
Enable or disable automatic saves based on the size of the internal log file | Enter the following command: options cifs.audit.autosave.onsize.enable {on | off} |