Unable to place RSA Authentication Manager 8.x troubleshooting logs larger than 2GB on SFTP for troubleshooting
4 years ago
Originally Published: 2018-10-29
Article Number
000041707
Applies To
RSA Product Set: SecurID
RSA Product/Service Type: Authentication Manager
RSA Version/Condition: 8.2.1, 8.2, 8.3
Issue
When generating and downloading  the Authentication Manager Troubleshooting logs, they are greater than 2GB in size, which is larger than the RSA SFTP site will accept.
Cause
The archive logs have been included in the Troubleshooting log zip, they should not be there.  This is a bug, tracked with JIRA AM-32362.
Resolution
Manually remove the archive logs from the Troubleshooting zip file.
Workaround
Install the download wizard from the RSA SFTP site and set the RSA SFTP site as trusted in your browser.  This should allow you to exceed the 2GB limit.
Notes
Archive logs are kept in /opt/rsa/am/server.  There are three types of audit logs:
  • audit_runtime refers to authentication activities
  • audit_admin refers to administrative activites by Super Admin and Help Desk administrators
  • system_ refers to system messages and errors
The log file names will include a date, year-month-day, such as _2018-06-29_0 and will have the extension of .log which is the actual text log file for a particular day or part of a day, or .log.sig which is the digital signature file for that particular log file.

For example, the three archive log file types for 29 June 2018 and their digital signature files; 
/opt/rsa/am/server/audit_admin_2018-06-29_0.log
/opt/rsa/am/server/audit_admin_2018-06-29_0.log.sig
/opt/rsa/am/server/audit_runtime_2018-06-29_0.log
/opt/rsa/am/server/audit_runtime_2018-06-29_0.log.sig
/opt/rsa/am/server/system_2018-06-29_0.log
/opt/rsa/am/server/system_2018-06-29_0.log.sig

While these files may be important for historic and legal reasons, they would not be helpful in troubleshooting a recent problem and should not be included in Troubleshooting logs.  Remove them from the .zip file to save space,
Don't see what you're looking for?