Audit logs

Audit messages are copied during replication from the remote audit database, if the Continuously Download Audit Logs checkbox is selected on the Setting up Database Copying page of the Replication Wizard.

After you have set up a replication connection, an audit management daemon begins to listen for connections from other daemons that have replication links established. A service running in the background verifies periodically if new auditing data has been written on the other systems. If this is the case, the data is copied.

Downloading audit logs can be enabled on either replication instance. The server where this setting is enabled will download all logs from its replication partner. If the setting is enabled on both instances, audit copying will work bi-directionally, and logs will be exchanged between both instances.

Audit copying can be chained. For example, if server A downloads audit logs from server B, and server B downloads the audit logs from server C, then server A will store the logs from servers A, B, and C.

Audit logs are copied, they are not replicated. The audit management daemon checks for new audit messages every few minutes. Audit messages are copied starting with the oldest audit messages first.