topic Re: LAUS/cron errors on RedHat AS 3.0 in Operating System - Linux

LAUS/cron errors on RedHat AS 3.0

TJ_16 — Thu, 25 Aug 2005 09:34:02 GMT

We decided to stop the audit process due to the ridiculous size of the log files it kept. To stop, I just did:
rpm -e laus, checked to make sure the audit process was gone and rm -rf /var/log/audit*.

Now, since doing that I get the following errors in my /var/log/cron file:
CROND[23053]: LAuS error - do_command.c:182 - laus_log: (19) laus_log: No such device

I am not 100% sure, but it seems to follow the /usr/lib/sa/sa1 1 1 cron.d job.

Any ideas?

I tried to reload the audit module, reinstall the laus package, and put alias char-major-10-224 off in /etc/modules.conf.

Thanks

Re: LAUS/cron errors on RedHat AS 3.0

Gopi Sekar — Thu, 25 Aug 2005 09:41:31 GMT

it looks like laus left entry in the crontab which tries to execute at periodic intervals.

if you do not want laus then check /etc/cron.* directories for any file containing laus entry, if so remove the file and you should be safe.

you should also check in /etc/crontab file for this entry, if found remove it from there too.

Hope this helps,
Gopi

Re: LAUS/cron errors on RedHat AS 3.0

John Poff — Thu, 25 Aug 2005 09:44:23 GMT

Hi,

I've got the same problem here. It looks like you also need to shutdown cron and atd, rmmod the audit kernel module, and then restart cron and atd.

Here is a link that I found in Bugzilla that explains it:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136657

JP

Re: LAUS/cron errors on RedHat AS 3.0

TJ_16 — Thu, 25 Aug 2005 10:18:44 GMT

I did stop the atd, crond, and syslog daemons, modprobe -r audit, then restarted those 3 processes. The audit module get reloaded by one of them and the erros will continue.

Were you able to get it to stop for you by doing this?

Re: LAUS/cron errors on RedHat AS 3.0

Ivan Ferreira — Thu, 25 Aug 2005 10:35:05 GMT

Verify if logrotate.conf is not trying to do some cleaup of the LAUS log files.

Re: LAUS/cron errors on RedHat AS 3.0

TJ_16 — Thu, 25 Aug 2005 10:39:12 GMT

I think I got it...

The bugzilla report seemed to work, even though I thought I had did that already.

Thanks for all the responses.

Re: LAUS/cron errors on RedHat AS 3.0

TJ_16 — Thu, 25 Aug 2005 10:41:02 GMT

add alias char-major-10-224 off to /etc/modules.conf
stop atd and crond
rmmod audit
start atd crond