The Default Destination defines where audit messages are sent when the Engine local audit repository is full, at a user-defined time (ADS Delivery Time attribute of Engine device), or when a user clicks the Forward Messages button in the Audit Viewer. Configure an ADS Audit Repository as the Default Destination to permanently store audit messages. For information on how to define a default destination, see Configuring the Engine Audit Repository.
When the Dial-Up Audit Forwarding Threshold is reached, all non-forwarded audits in the Local Audit Repository are forwarded to the defined ADS Repository.
To generate an alarm message when a Rollover or Stop condition occurs, set the Audit Generate Alarm When Full attribute in the Engine device to True. See Configuring the Engine Audit Repository and Audit Repositories.
You can forward audit messages to the Default Destination from the Engine local audit repository by clicking the Forward Messages button in the Audit Viewer. See Forwarding Audit Messages to the Default Destination.
- You cannot forward audit messages from an ADS audit repository to another ADS audit repository.
- You can define only one ADS audit repository as the Default Destination for messages from an Engine local audit repository; however, different Engines can have different ADS repositories defined as their Default Destination.
If you have not defined a Default Destination when the Engine local audit repository is 100% full, the local audit repository either replaces the oldest messages (rollover) with new messages or stops recording audits according to the Audit Action When Full attribute configuration.
Audit message rollover begins or replacement stops only when the total number of non-forwarded audit messages reaches the size defined by the Audit Repository Size attribute. In other words, once the local audit repository reaches the defined size, new audit messages continue to enter the local audit repository replacing forwarded messages until all forwarded messages are gone. The following figure illustrates the Audit Action When Full when set to Rollover or when set to Stop.
If you have defined a Default Destination, the Dial-Up Audit Forwarding Threshold attribute is set to any percentage other than 100%, and the Audit Action When Full attribute is set to Stop; then the audit messages do not stop rolling over as long as forwarding is successful. This situation occurs because audit messages are forwarded to the Default Destination when new audit messages are received, and the forwarded messages are automatically replaced. The local audit repository does not fill up with non-forwarded audit messages and, therefore, no alarm is generated.