Console and Syslog Message

Angela L. Shepherd_1 — Tue, 07 Nov 2000 16:12:28 GMT

Receiving the following Console message:
Audomon: Cannot stat the current audit file system.

Receiving the following message under /var/adm/syslog/messages:

The current audit file is switched from /usr45/audsys/af.dpas03.20001107105703
to /usr45/audsys/af.dpas03.20001107105704.
Notify the security officer to specify a backup.
No next (backup) audit file.

Re: Console and Syslog Message

Elizabeth_2 — Tue, 07 Nov 2000 16:17:18 GMT

Fix the problem by using the following steps:

1. audsys

The auditing system is currently on.
Current file: /secure/etc/audfile1.
Next file: /secure/etc/audfile2.
Statistics- afs Kb used Kb avail % fs Kb used Kb avail %
current file 1039 0 0 83733 16501 0
next file 1039 0 0 83733 16501 0

cd /secure/etc
ls
audfile1 audfile2 audname

2. Stay in the /secure/etc directory and execute:

touch audfile3
touch audfile4

audsys -c audfile3 -s 1039 -x audfile4 -z 1039

audsys

Current file: /secure/etc/audfile3.
Next file: /secure/etc/audfile4.
Statistics- afs Kb used Kb avail % fs Kb used Kb avail %
current file 1039 0 100 83733 16501 80
next file 1039 0 100 83733 16501 80

3. After reviewing the contents, issue the following commands:

cat /dev/null > audfile1
cat /dev/null > audfile2

4. Use the following command to set it back to the original files:

audsys -c audfile1 -s 1039 -x audfile2 -z 1039

topic Console and Syslog Message in Operating System - HP-UX

Console and Syslog Message

Re: Console and Syslog Message