topic Re: audit log full in Operating System - HP-UX

audit log full

Rashid Hamid — Tue, 21 Mar 2006 03:55:45 GMT

/log filesystem full because of audit trail log growing rapidly.
The size of /log is 2gb

Is there a way to trim or to stop auditlog when reaching certain limit?

Thanks

Re: audit log full

RAC_1 — Tue, 21 Mar 2006 03:58:26 GMT

What auidting?? hp-ux auditing?? Check acctresume and acctsuspend kernel tuables. these settings will decide, when auditing will stop on account of free epsace available.

Re: audit log full

Muthukumar_5 — Tue, 21 Mar 2006 04:04:53 GMT

Do you mean auding system log(s). You can configure with /etc/rc.config.d/auditing. See man audsys page more.

--
Muthu

Re: audit log full

Steven E. Protter — Tue, 21 Mar 2006 04:08:26 GMT

Shalom,

A script is needed to move the logs out of there once in a while.

#!/usr/bin/ksh

audsys -f
mv /home/secure/aud* /backups
audsys -n -c /home/secure/audfile1 -s 10000 -x /home/secure/audfile2 -z 10000

Change this code as you need it to handle the change.

SEP

Re: audit log full

Arunvijai_4 — Tue, 21 Mar 2006 04:20:05 GMT

Hello,

You can delete the unwanted log files, also, you can use logrotate,

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/logrotate-2.5/

-Arun

Re: audit log full

Muthukumar_5 — Tue, 21 Mar 2006 04:23:07 GMT

You can write a script to check file size of log file and trim simply as,

> logfile (to make file with 0 size)

or to stop

audisp -f

Automate with crontab to check every 5 seconds.

--
Muthu