topic Re: auditing and cron files in Operating System - HP-UX

auditing and cron files

Marcie Sirbaugh — Thu, 06 Nov 2003 11:36:05 GMT

I am trying to set up auditing on my server, however when I do my crons stop working. It appears that I have the latest patch applied (PHCO_27141), however, I still recieve the following message:

"Cron: Your job did not contain a valid audit ID."

Any suggestions??

Re: auditing and cron files

Pete Randall — Thu, 06 Nov 2003 11:44:32 GMT

Marcie,

I haven't got an answer but I believe I can narrow the cause. Quoting from "man 5 audit":

"Self-auditing Programs
To reduce the amount of log data and to provide a higher-level
recording of some typical system operations, a collection of
privileged programs are given capabilities to perform self-auditing.
This means that the programs can suspend the currently specified
auditing on themselves and produce a high-level description of the
operations they perform. These self-auditing programs include: at(1),
chfn(1), chsh(1), crontab(1), login(1), newgrp(1), passwd(1),
audevent(1M), audisp(1M), audsys(1M), audusr(1M), cron(1M), init(1M),
lpsched(1M), pwck(1M), and sam(1M). Note that only these privileged
programs are allowed to do self-auditing, and that the audit
suspension they perform only affects these programs and does not
affect any other processes on the system."

The fact that cron is one of these "self auditing programs" would seem to be the source of your issue here.

Pete

Re: auditing and cron files

Pete Randall — Thu, 06 Nov 2003 11:47:52 GMT

Here's a thread which addresses this question:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xc5f2f841489fd4118fef0090279cd0f9%2C00.html&admit=716493758+1068137209654+28353475

Pete

Re: auditing and cron files

Pete Randall — Thu, 06 Nov 2003 11:49:17 GMT

And another:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xc5f2f841489fd4118fef0090279cd0f9%2C00.html&admit=716493758+1068137209654+28353475

Pete

Re: auditing and cron files

doug hosking — Thu, 06 Nov 2003 19:48:01 GMT

Converting to a trusted system AFTER installing PHCO_28980 should fix the problem.
No cron patch will be able to help, nor will installing the tsconvert patch without rerunning the tsconvert. (The bug fixed in the patch caused cron's database of audit IDs to not be fully populated during the original conversion to a trusted system.)