topic Audevent in Operating System - HP-UX

Audevent

Belinda Dermody — Thu, 06 Oct 2005 15:07:02 GMT

I just started my audevent on my HPUX 11i to conicide with my running of tripwire. I see where I can define audfile2 and a switch over file when the audfile2 fills up, but what happens when my secondary file fills up which I have defined as audfile2a. The max I could put in the window was 99,000,000 for both files. I created a 1.5 gig lvol. I have it running now for about 3 hours and it has already written 16m of data.

Re: Audevent

Steven E. Protter — Thu, 06 Oct 2005 15:34:16 GMT

Please provide a copy of your audit file configuration. Then someone can recommend a change to stop this behavior.

You can also write a script to force a log change and write off the old logs to tape or some other form of storage. This option worked well for me in the past.

SEP

Re: Audevent

Belinda Dermody — Thu, 06 Oct 2005 15:55:02 GMT

AUDITING=0
PRI_AUDFILE=/.secure/etc/audfile2
PRI_SWITCH=80000
SEC_AUDFILE=/.secure/etc/audfile2a
SEC_SWITCH=80000