topic Audit logs in Operating System - HP-UX

Audit logs

Srinivas_3 — Wed, 16 Oct 2002 02:46:48 GMT

Actually my system has Informix running on it. We have converted one of our HPUX 11.0 system to trusted system. The same system has informix 9.21 running on it. Now the audit log shows event type 'kill', event number 37 and owner informix. This message in the audit log repeats for every 1sec. So this fills out the audit log very badly.

Any idea, what the event means? Also please point me to the right documentation for audit logs where we can debug the event types etc.

HPUX 11.0
Informix 9.21
L Class

Re: Audit logs

Animesh Chakraborty — Wed, 16 Oct 2002 04:24:24 GMT

This may give you some idea

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90742/B2355-90742_top.html&con=/hpux/onlinedocs/B2355-90742/00/00/67-con.html&toc=/hpux/onlinedocs/B2355-90742/00/00/67-toc.html&searchterms=logs%7caudit&queryid=20021015-230143

Re: Audit logs

doug hosking — Thu, 17 Oct 2002 13:37:38 GMT

System call 37 is the 'kill' system call.
(grep -i sys_kill
/usr/include/sys/scall_define.h)

While I don't know about the internals of informix, I can make a guess. Using kill(2) with a signal number of 0 is a convenient way of testing non-destructively to see if another process still exists. (See the kill(2) manual
page.) I would guess that a process is polling once a second to see if another process has died, and, if so, would restart it or do some similar cleanup.

/usr/include/sys/audit.h has some information on audit record types, but this information is subject to change between releases.

Re: Audit logs

Darren Prior — Thu, 17 Oct 2002 14:55:28 GMT

Hi,

In you are not interested in seeing this message then you could consider using audevent to turn off that event. I'd make sure that you know why it's happening first though :)

regards,

Darren.