 About audit
The system audit performs the following important functions in your FirstClass server:
• removing deleted items
• removing expired items
• deleting expired user accounts
• performing automatic updates
• performing repairs to your network store.
 CautionAudit performs repairs to your system, never disable this function.
The amount of time audit takes to run depends on the size and complexity of your network store and whether you run a full audit (on the whole system) or a single audit (on an individual user or container). It can range from hours for a large network store to a few minutes for a small one, or as little as a few seconds for a user. To find out how long audit takes on your FirstClass system, check the console messages, or server log files.
When you start your server, the console will display a message stating the time the next audit is scheduled to start.
 NoteIf the server has not been started in the current 24 hour period, audit will automatically start when the server is started.
When the audit ends, the console will display the date and time the next automatic audit is scheduled to start.
NoteThe server can deliver messages during audit, but audit cannot be performed on items in use.
While audit is running, you can stop it by issuing the stop command from the server console. On the console, choose:
Server > Stop Audit to stop the audit immediately (like a fast shutdown). Audit will resume at the current user the next time it starts.
Removing deleted items
The FirstClass server stores only a single copy of each message. For example, if you send a message to six different users, FirstClass saves only one copy of the file containing the message on the server and places a link to that file in each recipient’s Mailbox. When a recipient opens the link from his Mailbox or a conference, FirstClass opens the original file on the server. This method helps reduce disk space requirements when large messages are sent to multiple recipients.
When a recipient or the sender deletes the message from his Mailbox, the actual file is not deleted, only that user’s link to the message is deleted. A file can only be deleted when there are no more links to that file. For example, the file for a message sent to six people is deleted only after the sender and all six recipients have deleted it.
Undelete
The undelete command allows users to recover files they have deleted. However, these files cannot be recovered once an audit has occurred. You should inform users of this and of the time at which audit regularly occurs. You might also want to give users the opportunity to undelete items before performing a manual audit.
Removing expired items
An audit also deletes expired files. Every item in your system has an expiry date – a date after which it will automatically be deleted from the server. When the audit finds a file (or a link) whose expiry date has passed, it deletes the item. The expiry date is calculated by adding the expiry period to the date that the item was last edited.
You, as administrator, can set an expiry period for private mail and conference items in the System Profile. You can also set specific expiry periods for the entire contents of a conference.
Users can edit the expiry period for individual messages in their Mailbox using File > Get Info (Mac OS/Mac OS X) or File > Properties (Windows). You can also grant users the Set Expiry privilege in conferences and their Mailbox, allowing them to set expiry periods for messages they send. These expiry periods override all previous
settings.
Use expiry periods to avoid disk space shortages. The length of the expiry period should be based on the amount of disk space available on your server machine. If you have ample disk space and low traffic, consider a long expiry period (such as several years). If you are short of disk space, use a short expiry period (such as 30 days).
The audit automatically deletes expired items, even if they have not been read by all recipients.
Removing expired user accounts
You can configure audit to delete inactive user accounts. In the System Profile, specify the maximum period for which user accounts can be inactive. User accounts inactive for this length of time or longer are automatically deleted from your Directory, along with the contents of their Mailboxes.
FirstClass server updates
When audit runs, a number of log files and statistics reports are generated about the activity on your system and how your system is processing data. These log files and statistics reports are an essential tool in troubleshooting system errors.
Automatic full audit
By default, the FirstClass server is set to perform automatic full audit once a day.
Since a full audit may slow down your server, you should try to schedule automatic full audit for off-peak times when there are usually few users online. By default, the automatic full audit runs daily at 3:00 AM.
To change the scheduled time:
1 Choose Admin > System Profile on the administrator's Desktop.
2 Change the time at "Audit time" on the Timers tab.
Specifying a start and end time
If you specify a start and end time for automatic full audit, the console will display the scheduled audit end time when the audit begins. If you change the end time in the system profile while the audit is running, the change will not take effect until the next time the audit starts.
If the audit is stopped and then force started during the run-time window, it will stop at the end time specified on the system profile. (If it is force started outside of the run-time window it will run until the scheduled end time (or to completion, if that comes first)).
If the audit finishes before the scheduled end time, it will not run again until the next scheduled start time. (It will never loop back to the beginning.)
• If the audit does not complete before the end time, the audit will stop exactly where it is at the end time. The next time the audit runs it will start at the same user who was being audited when the audit was stopped.
If the audit began as a resumption of a previous stopped audit (did not complete before end time, or was stopped while running), and the audit reaches the end of the network store before the end time, the audit will end. It will never loop back to the beginning.
• If your server is not running when audit is scheduled to start and is started again before the specified end time, audit will run when the server starts, and will end at the specified end time.
• If the audit begins but the server is shut down while the audit is running (or the audit is stopped), the audit will not resume automatically. The audit will only start once during the run-time window.
Specifying a start time only
If you have specified a start time only audit will run to completion.
Since the default run-time window is 24 hours, if your server is not running when the audit is scheduled to start, audit will run when the server starts (and will run to completion (unless you stop it)).
If the audit starts and is manually stopped (the server is shutdown or you stop the audit), the audit will not resume again automatically in that 24-hour window. Audit will only run automatically once during the 24-hour run-time window.
Manual full audit
You can force the audit task to run immediately.
If you run out of disk space, you must delete unnecessary files. The disk space released as a result of these deletions, however, is not available until you force an audit.
To force a full audit do one of the following:
• from the administrator's Desktop choose Admin > Control > Audit
• from the server console choose System > Audit.
Since server performance is decreased during audit, you should only force a manual full audit when necessary; it's better to wait for automatic full audit, or to run a single audit on specific users or conferences.
NoteWe suggest that you disable logging before starting a manual full audit, as sessions on slow servers might experience communication link failures and be dropped.
Using audit to fix network store issues
In the past, when there was evidence of errors in the network store, it was strongly recommended to not run trash collection.
With the new audit capabilities, it is now strongly recommended that the first step in network store diagnostics and repair be to run an audit (on the user, conference or the entire server, depending on the issue).
The audit will repair the network store entirely if there is not a file sharing violation.
In some cases, some data is salvageable but the repair would need to be completed manually (restoring links to objects, etc.). In this case, an audit repair notification will be sent to the administrator's Mailbox. The information in the audit repair notification can be used by customer support to repair the problem. These issues are not time-sensitive and will not be damaged by subsequent audits.
Single audit
If a user or conference has damaged or missing data, a single audit can be run on the affected user or object to fix the damaged or missing files (this does not refer to manually deleted or moved messages or objects).
NoteUsers cannot use the Undelete command to recover their deleted files once an audit has been run.
1 Locate the user/conference in the List Directory.
2 Click Audit at the top of the form.
If the damage is repairable, the audit will repair it.
If the damage is not repairable automatically, but may be repairable manually, an audit repair notification will be sent to the administrator's Mailbox.
Single audits which are queued or running when the full audit is scheduled to start, will complete before the full audit begins.
NoteAudits of unlisted items must be done using the FirstClass scripting AUDIT command.
Console output messages
If the audit is initiated using the console menu, the console output message will look like the following:
If a full audit is initiated by the admin using the Admin menu, the console output message will look like the following:
 If a full audit is initiated by a user with subadmin privileges, the console output message will look like the following:
 If a single audit is initiated on a user, the console output message will look like the following:
 If a single audit is initiated on a conference (in this case, Finance Area), the console output message will look like the following:
 |