/sys$common/syshlp/helplib.hlb SET, AUDIT, Qualifiers, /THRESHOLD  *Conan The Librarian (sorry for the slow response - running on an old VAX)

       /THRESHOLD=type=value

    Specifies threshold values used in monitoring available space
    in the audit log file. The auditing system issues advisory
    messages to central and security operators whenever free space
    in the audit log file falls below the WARNING threshold. The
    auditing system suspends processes that generate audit events
    when free disk space is below the action threshold. (See
    /RESOURCE=[enable|disable]). The /JOURNAL qualifier is required.

    The following table lists the types of thresholds:

    Keyword        Description

    WARNING=value  Specifies the threshold at which the audit server
                   notifies all security operator terminals that
                   resources are getting low.

    ACTION=value   Specifies the threshold at which the audit server
                   starts suspending processes that are generating
                   audit records. (Certain processes are immune to
                   this: refer to OpenVMS Guide to System Security).

    RESUME=value   This keyword is obsolete.

                   Specifies the threshold at which the audit server
                   resumes normal system activity.

    The following table lists the default warning and action values
    for each monitoring mode:

    Mode                  Warning        Action

    Blocks                100            25
    Delta time            2 0:00:00      0 0:30:00