Auditing

[Angela L. Shepherd_1]

I can't get auditing to work on one of my systems. When I go into sam (select auditing and security and then audited events) I receive the following error message:

The attempt to modify the auditing configuration using audsys failed. The command return value was "-1" and the standard error output was: warning: cannot read badly formatted /.secure/etc/audnames current audit file /audsys/audsys/af.start1 insufficient space available on audit file filesystem, specify a different audit file of select a smaller AFS auditing system unchanged.

I can't remember how to specify a different audit file from the command line.

[Steven Sim Kok Leong · Accepted solution]

Hi,

# audsys -c pathname-of-new-audit-file -s size-in-kbytes

Hope this helps. Regards.

Steven Sim Kok Leong
Brainbench MVP for Unix Admin
http://www.brainbench.com

[Jason VanDerMark]

You could use

audsys -n -c auditlog.new

This should start auditing and set the current file(the one that all audit records are set in) to auditlog.new. It is best to set the current file to one that doesn't exist or to one that is empty. Hope this is what you were looking for. For more info check out the manpages on audit or audsys or any of the other audit commands.

Good Luck,
Jason V.

[Madhu Sudhan_1]

Hi Angela !

You can use

#audsys -n -c -s -x -z

"-n" stands for turning on the audit system and "-f" for turning off.

...Madhu

[Angela L. Shepherd_1]

I don't have a /.secure/etc/audnames file.

[Madhu Sudhan_1]

Hi Angela !
Looks to me like the "audnames" file is corrupted or not there. Turn off the auditing by using audsys and "-f" option and restore audnames file from the backup if you have backedup.

or

try

#touch /.secure/etc/audnames (to create an empty file)

and then turn on the auditing and the audit users and audit events. Ilooked for the format of audnames and couldn't find.

Hope this helps.
...Madhu