Audit Thread Utilization(%) Explained in detail.

[rajdeep_marathe]

This Blog post contains Details on what Audit Thread Utilization is and how is the (%) been calculated.

 

Introduction:

Auditing allows you to keep the records of events happening on the servers and applications.
Which helps:
- Give you a picture of what information is being accessed.
- How it's being accessed and changed
- And who is performing these operations.

This information is recorded in a database called the Auditing Data Store (ADS). Once the data is in the ADS, you can design custom reports to suit your needs.

---

Below is the calculation which goes:

Time taken to perform the auditing cycle * 100 / Last Polling Cycle Duration = Auditing Thread Utilization (%)

‘Last Polling Cycle Duration’ is 180 seconds or the time taken to perform the auditing cycle (whichever is greater).

This means the Auditing Thread Utilization (%) can never be > 100%



 

Note that the Auditing Thread Utilization is NOT related to the CPU utilization of the Auditing thread – it is just related to the amount of TIME it takes.

Conclusion

• When we see 100 % thread utilization on the Auditing page, it means:
  That CMS has taken 3 minutes or more to complete the previous cycle. (The issue could be anywhere, getting details from Servers, sending the details to the Audit DB, or CMS waiting for any operations) – e.g. large number of events to import, slow Audit database access (either read or write), network performance etc.


• If there is a problem process the auditing events from one of the servers the auditor will then move onto the next server (it will not delete the files in the Auditing folder even if it inserted some of them).


• If there is no data to be written and no audit events triggered since the last polling cycle, CMS still prompts the Server's to share the data to be written. And the server responds with no data to write.