How to remove NetWare Auditing (Auditcon)

Disabling NetWare Auditing

Novell NetWare 6

Novell NetWare 5.1

Novell NetWare 5.0

Novell Intranetware 4.11

Novell Small Business Suite 5.1

Novell Small Business Suite 5.0

Novell IntraNetWare for Small Business 4.11

AUDITCON v 4.34, v4.35

Receiving -682 Errors After Disabling Container Auditing

Unable to disable auditing

Error: "FD56 when attempting to re-enable auditing on a container"

Receive -682 (Auditing_Failed) in DSREPAIR | Report Synchronization Status for a server in the Replica ring.

DSREPAIR report synchronization status shows partition not in sync

Receiving -682 when modifying any object in the container that auditing was disabled on.

Error: "Audit overflow file is almost full."

Recently disabled container auditing.

Changes made to Container Auditing were not fully synchronized.

1.  Ensure Container Auditing is disabled.
2.  Delete the AFO0_ object(s) for the affected container with NWADMIN32. (If you get a -682 when deleting the AFO0_ object(s) or if it states the object is in use, go to the server console and load DSBROWSE -A | Tree Browse (browse to and highlight the object you wish to delete) | Press F3 | Delete Selected Object | Log in with  a user with Admin rights.
3.  With NDSmanager or DSREPAIR, make note of all the servers that hold any type of replica of the Partition in which the audited container exists.

If you are unsure which servers hold replicas and/or which servers have auditing enabled, Load NETBASIC, Load SHELL, you should be presented with a SYS:\> prompt

Search the _NETWARE dir for the following  *.$AF  You will see something similar to this:

4.  Download AUDITFIX.NLM and copy AUDITFIX.NLM to SYS:SYSTEM\ on all servers with Auditing files which need to be cleaned up.
5. Go to each of the servers that participate in that "replica ring" and perform the following steps:  
NOTE:  The following steps must be done on all servers at the same time that participate in the replica ring:
        a. Verify NWAUDIT.NLM and DS.NLM are unloaded
        b. Load AUDITFIX.NLM and follow the screens below:
     


Answer "Y" if you wish to disable auditing

If DS.NLM has not previously been unloaded the Audit Repair tool will ask if you wish to Continue.  Answer "Y" to unload Directory Services and continue. 



If the AUDITFIX.NLM is unable to unload DS.NLM or NWAUDIT.NLM (or DSBROWSE.NLM or DSREPAIR.NLM) the following screen will be displayed. If this happens, toggle to the System Console and unload any of the above NLM's.  After unloading both NLM's, Press "Y" to continue. 

Once the above screen is displayed, the Auditing Cleanup is Complete: "Press Any Key to Exit" 


NetWare Auditing should be removed.

DS.NLM has a dependency on DSAUDIT.NLM.  In other words, DSAUDIT.NLM needs to be loaded before DS.NLM will load.  However, the fact that DSAUDIT.NLM is loaded does not signify that the auditing feature is functional.  To verify that auditing has been successfully removed, type the following at the server console:  SET DSTRACE = +AUDITSKULK.  Change to the Directory Services screen.  There should be no auditing activity.