3 Replies Latest reply on Oct 22, 2008 5:33 AM by Greg Kullberg

    Architecture difference between audit against live server and snapshot

      Could you please describe me what is difference in architecture between auditing against snapshot and against live server?

       

      I would guess that BL every time has to collect information from server and after that it runs audit against collected information, but time consumed by both ways are different.

       

      Can you please describe what is difference? If this is in docs, please send me page # :).

       

      Thanks

        • 1. Re: Architecture difference between audit against live server and snapshot

          Audit against live: Data is collected from the "master" server each time you execute the job. It will query the attributes of each object on the master via the agent and then use that to compare it against each target. This is slower because you have to re-query the contents of the master each time you execute the audit job.

           

          Audit against snapshot: Data is collected from the snapshot master which lives in the database, and then compared against each target. This operation will be much faster as you are querying direct from the DB to each target.

          • 2. Re: Architecture difference between audit against live server and snapshot

            I am not sure if I understood it well.

             

            Live audit means that it scans master, stores information in DB or some cache and than is this temporary image used to compare target or each agent scans master and compares it to itself?

             

            I mean if the master changes every time and so I have to do snapshot every time to get the information, is better to do snapshot or live audit?

             

            Thanks

            • 3. Re: Architecture difference between audit against live server and snapshot

              Live audit means that it scans the master and stores that info temporarily in the DB / some cache to compare against all the targets (from what I understand).

               

              If the master changes every time, then you will want to use a live audit. An audit based off a snapshot will be faster, but if your master is changing every time it may make more sense to keep it as a live audit instead of re-taking a snapshot each time, and then going into the audit job to change the master to the new snapshot.

               

              Snapshots are best when your master is unchanging.