https://community.hpe.com/t5/operating-system-hp-ux/audit-file-switching/m-p/4178325#M733600 Hello all<BR />i just enabled auditing facility on a HPUX 11.23 system.<BR /><BR />For testing i used default vaules except audit files; here are the parameters used:<BR />AUDITING=1<BR />#PRI_AUDFILE=/.secure/etc/audfile1<BR />PRI_AUDFILE=/var/audit/current<BR />PRI_SWITCH=1000<BR />#SEC_AUDFILE=/.secure/etc/audfile2<BR />SEC_AUDFILE=/var/audit/next<BR />SEC_SWITCH=1000<BR />AUDEVENT_ARGS1="-P -F -e moddac -e login -e admin"<BR />AUDEVENT_ARGS2=""<BR />AUDEVENT_ARGS3=""<BR />AUDEVENT_ARGS4=""<BR />AUDOMON_ARGS="-p 20 -t 1 -w 90"<BR /><BR />After audit was started, the file size was reached without switching.<BR /><BR />Is anything wrong in this?<BR /><BR />Thanks in advance<BR />RV Fri, 11 Apr 2008 08:55:18 GMT Roberto Volsa 2008-04-11T08:55:18Z https://community.hpe.com/t5/operating-system-hp-ux/audit-file-switching/m-p/4178325#M733600 Hello all<BR />i just enabled auditing facility on a HPUX 11.23 system.<BR /><BR />For testing i used default vaules except audit files; here are the parameters used:<BR />AUDITING=1<BR />#PRI_AUDFILE=/.secure/etc/audfile1<BR />PRI_AUDFILE=/var/audit/current<BR />PRI_SWITCH=1000<BR />#SEC_AUDFILE=/.secure/etc/audfile2<BR />SEC_AUDFILE=/var/audit/next<BR />SEC_SWITCH=1000<BR />AUDEVENT_ARGS1="-P -F -e moddac -e login -e admin"<BR />AUDEVENT_ARGS2=""<BR />AUDEVENT_ARGS3=""<BR />AUDEVENT_ARGS4=""<BR />AUDOMON_ARGS="-p 20 -t 1 -w 90"<BR /><BR />After audit was started, the file size was reached without switching.<BR /><BR />Is anything wrong in this?<BR /><BR />Thanks in advance<BR />RV Fri, 11 Apr 2008 08:55:18 GMT https://community.hpe.com/t5/operating-system-hp-ux/audit-file-switching/m-p/4178325#M733600 Roberto Volsa 2008-04-11T08:55:18Z