topic Re: Problem with AuditExtBundle in Operating System - HP-UX

Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 12:15:26 GMT

I have installed (thought I have) this bundle.
When I tried to start auditdp, it was not installed, and the coresponding libs too.

I opened the depot with 7zip to look after this, copied this files to their places and gave them their rights.

When I tried :
auditdp -r /var/.audit/audtrail
I got this message:
Failed to raise SELFAUDIT privilege for auditdp - Not owner
[1] 9748

What happens?

Regards
Karl-Heinz Delzeit
aps39-79.usa.hp.com-root# uname -a
HP-UX aps39-79 B.11.31 U ia64 3043818272 unlimited-user license
aps39-79.usa.hp.com-root# swverify AuditExt

======= 08/18/10 08:57:52 MESZ BEGIN swverify SESSION
(non-interactive) (jobid=aps39-79.usa.hp.com-0021)

* Session started for user "root@aps39-79.usa.hp.com".

* Beginning Selection
* Target connection succeeded for "aps39-79.usa.hp.com:/".
* Software selections:
AuditExt,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP
AudFilter.AUDFILTER-CONF,l=/,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA/PA
AudFilter.AUDFILTER-KRN,l=/,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA
AudFilter.AUDFILTER-MAN,l=/,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA/PA
AudFilter.AUDFILTER-RUN,l=/,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA
AudReport.AUDREPORT-MAN,l=/,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA/PA
+ PHKL_41238.CORE2-KRN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHKL_41239.CORE2-KRN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
* A "+" indicates an automatic selection due to dependency or
the automatic selection of a patch or reference bundle.
* Selection succeeded.

* Beginning Analysis
* Session selections have been saved in the file
"/.sw/sessions/swverify.last".
* The analysis phase succeeded for "aps39-79.usa.hp.com:/".
* Verification succeeded.

NOTE: More information may be found in the agent logfile using the
command "swjob -a log aps39-79.usa.hp.com-0021 @
aps39-79.usa.hp.com:/".

======= 08/18/10 08:57:54 MESZ END swverify SESSION (non-interactive)
(jobid=aps39-79.usa.hp.com-0021)

aps39-79.usa.hp.com-root# swjob -a log aps39-79.usa.hp.com-0021 @ aps39-79.usa.hp.com:/
======= 08/18/10 08:57:53 MESZ BEGIN verify AGENT SESSION (pid=2837)
(jobid=aps39-79.usa.hp.com-0021)

* Agent session started for user "root@aps39-79.usa.hp.com".
(pid=2837)

* Beginning Analysis Phase.
* Target: aps39-79.usa.hp.com:/
* Target logfile: aps39-79.usa.hp.com:/var/adm/sw/swagent.log
* Reading source for file information.
* Configured AudFilter.AUDFILTER-KRN,l=/,r=B.11.31.03.01
* Configured AudFilter.AUDFILTER-CONF,l=/,r=B.11.31.03.01
* Configured AudFilter.AUDFILTER-MAN,l=/,r=B.11.31.03.01
* Configured AudFilter.AUDFILTER-RUN,l=/,r=B.11.31.03.01
* Configured PHKL_41238.CORE2-KRN,l=/,r=1.0
* Configured PHKL_41239.CORE2-KRN,l=/,r=1.0
* Configured AudReport.AUDREPORT-MAN,l=/,r=B.11.31.02.01

* Summary of Analysis Phase:
Verified AuditExt,l=/,r=B.11.31.03.01
Verified AudFilter.AUDFILTER-KRN,l=/,r=B.11.31.03.01
Verified AudFilter.AUDFILTER-CONF,l=/,r=B.11.31.03.01
Verified AudFilter.AUDFILTER-MAN,l=/,r=B.11.31.03.01
Verified AudFilter.AUDFILTER-RUN,l=/,r=B.11.31.03.01
+ Verified PHKL_41238.CORE2-KRN,l=/,r=1.0
+ Verified PHKL_41239.CORE2-KRN,l=/,r=1.0
Verified AudReport.AUDREPORT-MAN,l=/,r=B.11.31.02.01
* 7 of 7 filesets had no Errors or Warnings.
* The Analysis Phase succeeded.

======= 08/18/10 08:57:54 MESZ END verify AGENT SESSION (pid=2837)
(jobid=aps39-79.usa.hp.com-0021)
aps39-79.usa.hp.com-root#

These are NOT installed.

AudReport.AUDREPORT-INC,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA/PA
AudReport.AUDREPORT-OPT,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA/PA
AudReport.AUDREPORT-RUN,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA

Why?

Re: Problem with AuditExtBundle

Patrick Wallek — Wed, 18 Aug 2010 12:21:49 GMT

How did you do the install? Did you check the log file(s) to see if any errors were reported? What happens if you try to install again?

Re: Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 12:33:16 GMT

The reporting tools are interesting, because I would like to write filtered audit results in readable flat files.

I have tried to install again, with the same result.

Re: Problem with AuditExtBundle

Patrick Wallek — Wed, 18 Aug 2010 12:35:51 GMT

OK, so what is in the installation logs? What messages came up on the screen during the installation?

In /var/adm/sw the swinstall.log and swagentd.log can sometimes have useful information.

Re: Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 12:36:18 GMT

Sorry, forgot the swinstall.log:

* Software selections:
AuditExt,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP
AudFilter.AUDFILTER-CONF,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA/PA
AudFilter.AUDFILTER-KRN,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA
AudFilter.AUDFILTER-MAN,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA/PA
AudFilter.AUDFILTER-RUN,r=B.11.31.03.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.03.01,fa=HP-UX_B.11.31_IA
AudReport.AUDREPORT-INC,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA/PA
AudReport.AUDREPORT-MAN,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA/PA
AudReport.AUDREPORT-OPT,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA/PA
AudReport.AUDREPORT-RUN,r=B.11.31.02.01,a=HP-UX_B.11.31_IA/PA,v=HP,fr=B.11.31.02.01,fa=HP-UX_B.11.31_IA
+ PHCO_38507.CONTAINMNT-RUN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_38507.CTMT-ENG-A-MAN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHCO_38821.AUDT-ENG-A-MAN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHCO_38821.SECURITY2,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_38823.CORE2-64SLIB,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_38823.CORE2-SHLIBS,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_38824.CORE-64SLIB,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHCO_38824.CORE-ENG-A-MAN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHCO_38824.CORE-SHLIBS,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHCO_38824.CORE2-64SLIB,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_38824.CORE2-SHLIBS,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_41240.CORE2-64SLIB,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHCO_41240.CORE2-SHLIBS,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHKL_38290.CORE2-KRN,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHKL_41238.CORE2-KRN,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHKL_41239.C-INC,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHKL_41239.CORE2-KRN,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHNE_38153.INETSVCS-INETD,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA/PA
+ PHNE_38153.INETSVCS2-INET,l=/,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
+ PHNE_38419.INETSVCS2-RUN,r=1.0,a=HP-UX_B.11.31_IA/PA,v=HP,fr=1.0,fa=HP-UX_B.11.31_IA
* A "+" indicates an automatic selection due to dependency or
the automatic selection of a patch or reference bundle.
* Beginning Analysis
* "aps39-79.usa.hp.com:/": 23 filesets have the selected
revision already installed.
* "aps39-79.usa.hp.com:/": 1 check scripts failed.
* "aps39-79.usa.hp.com:/": 4 software objects were determined
to be skipped in the analysis phase.
* "aps39-79.usa.hp.com:/": The software dependencies for 2
products or filesets cannot be resolved.
* "aps39-79.usa.hp.com:/": 1 bundles have the selected revision
already installed.
* Ending Analysis
* Before starting Installation, you should be aware of the
following:

The kernel will be re-built on the local system.

The system will be rebooted as soon as Installation is
complete.

Do you still wish to start Installation?
* Beginning Task Execution
* Proceeding with Task Execution on the following targets:
* aps39-79.usa.hp.com:/
* "aps39-79.usa.hp.com:/": 7 software objects were determined
to be skipped in the analysis phase.
* "aps39-79.usa.hp.com:/": 16 filesets had warnings.
* Ending Task Execution
* Your local system will be rebooted when you press "OK" in this
window. Check the logfile "/var/adm/sw/swagent.log" after
reboot to see if there were any software configuration
problems.

Re: Problem with AuditExtBundle

Patrick Wallek — Wed, 18 Aug 2010 12:39:33 GMT

Here is the interesting section:

* "aps39-79.usa.hp.com:/": 1 check scripts failed.
* "aps39-79.usa.hp.com:/": 4 software objects were determined to be skipped in the analysis phase.
* "aps39-79.usa.hp.com:/": The software dependencies for 2 products or filesets cannot be resolved.

You need to figure out why this is.

Check the swagent.log and swagentd.log for more details on those messages.

Re: Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 12:47:33 GMT

I think I have seen it in the swagent.log:

The corequisite
"AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_IA |
AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_PA"
for fileset "AudReport.AUDREPORT-INC,r=B.11.31.02.01" cannot
be successfully resolved.
ERROR: The dependencies for fileset
"AudReport.AUDREPORT-INC,r=B.11.31.02.01" cannot be resolved
(see previous lines).
You must resolve the above dependencies before operating on
this fileset or change the "enforce_dependencies" option to
"false".
The corequisite
"AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_IA |
AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_PA"
for fileset "AudReport.AUDREPORT-OPT,r=B.11.31.02.01" cannot
be successfully resolved.
ERROR: The dependencies for fileset
"AudReport.AUDREPORT-OPT,r=B.11.31.02.01" cannot be resolved
(see previous lines).
You must resolve the above dependencies before operating on
this fileset or change the "enforce_dependencies" option to
"false".
* Executing preDSA command.
NOTE: The used disk space on filesystem "/" is estimated to decrease
by 16 Kbytes.
This will leave 793440 Kbytes of available user disk space
after the installation.
NOTE: The used disk space on filesystem "/stand" is estimated to
increase by 23096 Kbytes.
This will leave 1346520 Kbytes of available user disk space
after the installation.
NOTE: The used disk space on filesystem "/usr" is estimated to
increase by 1792 Kbytes.
This will leave 2469408 Kbytes of available user disk space
after the installation.
NOTE: The used disk space on filesystem "/var" is estimated to
increase by 5056 Kbytes.
This will leave 3783696 Kbytes of available user disk space
after the installation.
NOTE: The bundle "AuditExt,r=B.11.31.03.01" will be reinstalled
because the "reinstall" option is set to "true".

* Summary of Analysis Phase:
ERROR: Exclude AudReport.AUDREPORT-RUN,r=B.11.31.02.01
ERROR: Exclude AudReport.AUDREPORT-INC,r=B.11.31.02.01
ERROR: Exclude AudReport.AUDREPORT-OPT,r=B.11.31.02.01
ERROR: 3 of 28 filesets had Errors.
* 4 of 28 filesets will be Skipped.
* 21 of 28 filesets had no Errors or Warnings.
ERROR: The Analysis Phase had errors. See the above output for
details.

Re: Problem with AuditExtBundle

Patrick Wallek — Wed, 18 Aug 2010 12:56:42 GMT

AUDREPORT-INC and AUDREPORT-OPT both depend on AUDREPORT-RUN. It appears the the AUDREPORT-RUN is either not in the package you are installing or is not getting marked for installation for some reason.

You now need to figure out why the AUDREPORT-RUN is not getting installed.

Re: Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 13:07:28 GMT

At the moment I am downloading the newest SecureShell, because of the message.
But what is the "checkinstall" script ?

ERROR: The installed version of SecureShell product is not compatible
with Audit Reporting features. Please update SecureShell to
version A.05.10.047 or greater.
ERROR: Auditing is currently enabled on the system. Please stop
auditing before installing this product
WARNING: After installation of this product, please enable auditing and
use a different audit trail using the audsys(1m) command. The
audit subsystem will start using an enhanced version of the
audit trail format.
ERROR: The "checkinstall" script for "AudReport.AUDREPORT-RUN" failed
(exit code "1"). The script location was
"/var/tmp/BAA010907/catalog/AudReport/AUDREPORT-RUN/checkinstall".

* This script had errors and the execution of this fileset
cannot proceed until the problem is fixed. Check the above
output from the script for further details.
The corequisite
"AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_IA |
AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_PA"
for fileset "AudReport.AUDREPORT-INC,r=B.11.31.02.01" cannot
be successfully resolved.
WARNING: The dependencies for fileset
"AudReport.AUDREPORT-INC,r=B.11.31.02.01" cannot be resolved
(see previous lines).
The operation on this fileset will still be attempted even
though there are unresolved dependencies because the
"enforce_dependencies" option is set to "false".
The corequisite
"AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_IA |
AudReport.AUDREPORT-RUN,r=B.11.31.02.01,fa=HP-UX_B.11.31_PA"
for fileset "AudReport.AUDREPORT-OPT,r=B.11.31.02.01" cannot
be successfully resolved.

Re: Problem with AuditExtBundle

Patrick Wallek — Wed, 18 Aug 2010 13:19:42 GMT

That make sense now. Updating to the supported version of SSH should then allow you to install all of the AUDREPORT packages.

>>But what is the "checkinstall" script ?

There are scripts that are part of the software depots and checkinstall is one of those. It basically checks prerequistes / requirements for the software you are installing. You typically don't need to worry about any of these.

Re: Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 13:40:13 GMT

Thank you for your help.

The checkinstall script canceled because of the SecureShell version.

Now the installation is running ok.

Re: Problem with AuditExtBundle

Karl-Heinz Delzeit — Wed, 18 Aug 2010 13:53:55 GMT

All runs ok now