Audit file switching

[Roberto Volsa]

Hello all
i just enabled auditing facility on a HPUX 11.23 system.

For testing i used default vaules except audit files; here are the parameters used:
AUDITING=1
#PRI_AUDFILE=/.secure/etc/audfile1
PRI_AUDFILE=/var/audit/current
PRI_SWITCH=1000
#SEC_AUDFILE=/.secure/etc/audfile2
SEC_AUDFILE=/var/audit/next
SEC_SWITCH=1000
AUDEVENT_ARGS1="-P -F -e moddac -e login -e admin"
AUDEVENT_ARGS2=""
AUDEVENT_ARGS3=""
AUDEVENT_ARGS4=""
AUDOMON_ARGS="-p 20 -t 1 -w 90"

After audit was started, the file size was reached without switching.

Is anything wrong in this?

Thanks in advance
RV