A more cautious approach to archiving your audit data is to verify the data seals, and to confirm that the archive and load are successful prior to deleting the data from your production database. If your production database is online during this archive procedure, you need to specify a date or date range for the audit archive. Specifying a date or date range guarantees that you will archive the same records in Step 1 and Step 3 below. If you specify one date, all audit data records up to the specified date are archived; if you specify two dates, all records between the two dates (inclusive) are archived. If your production database is called prod-db, and your archive is arch-db, and you want to archive all data prior to midnight on August 31, 2005 EDT, these are the basic steps:
1. Archive the data, checking the data seal as you archive:
This command archives all the audit data currently in prod-db to the file /usr1/audit_archives/prod-db.abd, but does not delete any of the audit data from prod-db because of the -nodelete qualifier. The -checkseal qualifier, directs the archive process to verify the data seal of each audit data record prior to archiving it.
This command loads all the audit data currently stored in the /usr1/audit_archives/_aud-audit-data.abd. file into the arch-db database, checking the seal of each audit data record prior to loading it into the archive database.
