topic Re: System audit (audsys) filling the file system and hanging the system in Operating System - HP-UX

System audit (audsys) filling the file system and hanging the system

unix adm — Tue, 28 Jul 2009 11:07:17 GMT

Experts!

Enabling system audit on my system is filling the /var file system and hanging the complete system and i have to go for reboot to fix it.

it keeps on creating new files and fill the filesystem , even new sparate file system for audit has same ending.

Is there anyway to limit the space utilization by system audit (audsys) or to make it run smoother.

in /etc/rc.config.d/auditing I have following arguments for daemon.

Thanks in Advance!

Rajeev!

AUDOMON_ARGS=" -p 20 -t 1 -w 90"

Re: System audit (audsys) filling the file system and hanging the system

Duncan Edmonstone — Tue, 28 Jul 2009 11:15:51 GMT

On a busy system there can be literally thousands of auditing events to record every minute, so in these sorts of situations you have 2 choices:

1) Provide considerably more disk space and implement a mechanism to archive audit logs regularly.

2) Choose to audit less things - see the man pages for audevent and audusr for info on how to choose what to audit...

HTH

Duncan

Re: System audit (audsys) filling the file system and hanging the system

unix adm — Wed, 29 Jul 2009 03:41:10 GMT

This does not look normal to me its filling up even more than 2 GB separate file system.

Thanks
Rajeev

Re: System audit (audsys) filling the file system and hanging the system

Dennis Handly — Wed, 29 Jul 2009 05:49:49 GMT

>This does not look normal to me

You asked that it log that much info. You need to wade through what you got to see what you don't need.

Re: System audit (audsys) filling the file system and hanging the system

likid0 — Wed, 29 Jul 2009 07:33:15 GMT

And also is a good idea to create and independent FS, for your audit files.

I usually create a /.secure 2 gig FS.

But I only audit root actions.

Re: System audit (audsys) filling the file system and hanging the system

George Jolightson — Wed, 29 Jul 2009 08:45:16 GMT

I think you are talking about 11.31. you have to create a new file system and mount it under /var/.audit. Also you have to verify what and all transactions you actully need audit.

Refer http://www.docs.hp.com/en/5992-3387/5992-3387.pdf

Thanks

George