topic Audit File Size Error in Operating System - HP-UX

Audit File Size Error

Mark Gibson_6 — Tue, 08 Feb 2005 11:58:47 GMT

I am getting the message...
"current audit file size is xxxxx kilobytes.
An attempt to switch to the backup file failed.
Must specify a backup file now!" ...
about every 30 seconds on my HP-UX server. Can someone please tell me where to go to change the audit files? I am a new UNIX user and I have not seen this error message before.

Re: Audit File Size Error

RAC_1 — Tue, 08 Feb 2005 12:13:56 GMT

check the file system where you store the audit file. Also look at the kernel tunables acctresume and acctsuspend which control the sizes when accounting will stop and resume.

Anil

Re: Audit File Size Error

David Child_1 — Tue, 08 Feb 2005 13:53:34 GMT

Mark,

Perhaps you do not have a 'next' audit file to switch to. Run the following to check your current settings:

# audsys
auditing system is currently on
current file: /var/adm/logs/audit/audfile1
next file: none
...

If there is no 'next file' then the system cannot switch it. Do something like the following to set it up if this is the case:

# audsys -f
# mv /var/adm/logs/audit/aud* /var/adm/backups
# audsys -n -c /var/adm/logs/audit/audfile1 -s 10240 -x /var/adm/logs/audit/audfile2 -z 10240

Check the man page for audsys for details. Also, once it switches to audfile2 you no longer have a 'next file'. It is best to write a script to automate the log maintenance.

David