Why EZproxy logs "suspension cleared by expiration" (sometimes delayed, sometimes in large batches)
Applies to
- EZproxy
Answer
In EZproxy, the audit log entry "suspension cleared by expiration" indicates that a previously recorded UsageLimit suspension has expired. However, EZproxy does not necessarily write this audit entry at the exact moment the suspension expires. Instead, EZproxy records the "cleared by expiration" event only when it performs an expiration check, which happens in three common scenarios:
• When the suspended user attempts access again (typically produces a single audit entry)
• When an administrator views the UsageLimit suspension list in the admin interface (can produce many audit entries at once)
• When EZproxy is restarted (can produce many audit entries at once)
This behavior can make it appear as though suspensions are being cleared "late," or that many suspensions were cleared at the same time.
What "suspension cleared by expiration" means
This message means the suspension has reached its configured expiration time (based on your UsageLimit ... -expires=... value) and is no longer in effect.
Why the audit entry may be delayed
EZproxy may not log the clearance at the moment the timer runs out. For example:
• A user is suspended for 10 minutes
• The user does not attempt access again for 6 hours
• The suspension effectively ended after 10 minutes, but the audit log entry "suspension cleared by expiration" may not appear until the user returns 6 hours later
In other words, the audit log records when EZproxy noticed and verified the expiration - not necessarily when the suspension technically ended.
The three scenarios (and what to expect)
1) Suspended user attempts access again (usually one entry)
When a suspended user returns and tries to access EZproxy, EZproxy checks that user’s suspension status. If the suspension has already expired, EZproxy records a single audit entry indicating the suspension was cleared by expiration for that user/event.
Typical outcome: one "cleared by expiration" entry associated with that user returning.
2) Admin views the UsageLimit suspension list (can generate many entries)
When an administrator opens the UsageLimit page that displays recorded suspensions (for example:EZproxy Administration → View usage limits and clear suspensions → View suspensions recorded → All), EZproxy performs an expiration check across the recorded suspensions.
If multiple suspensions have expired since the last time EZproxy performed this check, EZproxy may record many "suspension cleared by expiration" audit entries in a short period.
Typical outcome: dozens or hundreds of "cleared by expiration" entries clustered together.
3) EZproxy restart (can generate many entries)
When EZproxy restarts, it may also perform an expiration check against recorded suspensions. If there are multiple expired suspensions at that time, EZproxy may record many "suspension cleared by expiration" entries during startup.
Typical outcome: a burst of "cleared by expiration" entries at or shortly after restart time.
Why many entries can share the same timestamp
Audit log timestamps are commonly recorded with 1-second resolution. If EZproxy records many expiration clearances during an admin-page view or restart, they can all appear with the same timestamp even though they were processed sequentially.
Summary
• Single delayed entry: When an individual suspended user returns after the suspension has already expired, EZproxy may log the clearance at that time (even if the suspension ended earlier).
• Bulk entries: Viewing the admin UsageLimit suspension list or restarting EZproxy can cause EZproxy to record many "cleared by expiration" entries at once if multiple expired suspensions exist.