Layer7 API Management

It seems that on Layer7 the performance is decreased by increasing the audits and adding more log sinks. We are not sure what is causing such a drop in performance and would like to see if we can remove the audit sink part so that the audits only write to the files at `/opt/SecureSpan/Gateway/node/default/var/logs` and not to the Gateway database.

So two question regarding this -
1. Where in the database are those audits stored? Which table? I have looked around in the ssg database and have not found any of the audits for both the ssg one and the custom ones we have made.
2. Is it possible to turn off the database audits and only write to the directory above?

for Question1:

Logs are stored in ssg.audit_main and ssg.audit_details  which you see in PolicyManager Gateway Audit Events

For Question2:

From Policy manager, Go to Tasks-> Manage Log/Audit Sinks -> Select ssg log -> Manage Audit Sink and uncheck "Save audit records to Gateway database"

Regards,

Ganesh

Thanks for the reply Ganesh. We have created audit sinks correctly but question was more towards - 

1) Can we create audit sink which only logs to file? There is no database hit per audit log in such case?

2) I think we did create file only sink but we still some db writes and our throughput goes down dramatically. Are there any other settings we should tweak so that we get better performance?

Hey Sachin,

Make sure when you are using the 'Audit Details' assertion, that you are leveraging the 'log' option and not the default 'audit' option within that assertion..... I've also personally seen better performance when that log sink has a larger file size configured, delaying the 'log rotation' from happening...

Can you post what your requirements are in regards to throughput and what you currently are getting now? This will give everyone an idea of what your goals are and how close we are to obtaining them..

thanks!