XOS: \UNKNOWN appears in XOS AUDIT log
Check the following entries in the OSACL.
EXPLICIT_NODES OFF and REMOTE_PROCESS_LOOKUP OFF
EXPLICIT_NODES should only be turned ON if you have a fast expand network and fast system at each node. Turning both ON could affect performance. It is recommended to evaluate the speed and performance of your expand network to determine if turning EXPLICIT nodes ON will be a good fit.
REMORE_PROCESS_LOOKUP OFF is going to prevent XOS from looking up information about remotes processes.
If there are expand nodes that do not reliably respond in a timely manner, it is suggested to leave this OFF.
Additional information can be found within the XOS Manual, in the appendix sections A18 and A26.
If this article did not provide a solution, please open a case with our support team by sending an email message to support@xypro.com.
Related Articles
XOS: Why am I seeing \UNKNOWN in the XOS Audit Report?
Below are two possible reasons "\unknown" is seen in a XOS Audit Report for node name: A. When the EXPLICIT_NODES is OFF and you try to execute a FUP program on \one node to purge a file on another you see \UNKNOWN on the SUBJECT-SYSTEM field as ...
XOS: Audit of $:?? plus additional characters are showing up in the audit files.
Fix: Include the MASK RE:"^\$\:" in the POGROUP The following example suppresses audits for $:?? processes: POGROUP NO-POGROUP-AUDITS DESCRIPTION "Stop logging NORECORDS" ! *** Selection Criteria *** MASK RE:"^\$:" ! *** Access Granted *** ACL ...
How to resize XOS audit files
TACL> VOLUME $<VOLUME>.<XYGATEOS INSTALLATION SUBVOLUME> TACL> RUN XOS INSTALL TACL> EDIT OSCONF Edit the line AUDIT <FILENAME> EXT(<PRIMARY>, <SECONDARY>, <MAX EXTENTS>) (size of an audit trail can be controlled with the EXT option) eg: TACL> AUDIT ...
XOS: What does "Ignored PROG" mean in XOS audit?
The message means that XOS has ignored the action referenced in the audit record because there is nothing for XOS to rule on. No action is required. If you are unable to locate the solution needed or if you need additional assistance please Click ...
XOS: NORECORD IGNORED causing frequent audit rollover
If you want to get rid of ?IGNORED?s, set the AUDIT-NORECORD keyword to OFF in the OSCONF. Additionally, depending on whether or not you want NORECORD audits for non-IGNORE entries, just setting AUDIT_NORECORD OFF wouldn't work. You would also need a ...