Audit file has 0% free space left !

[Kasi_1]

I have an issue with one of my HP server. We are having HP-UX 11.23. A week back I activated audit logging. Now when I try to login to the HP UX server from remote I am getting the following error

login: root
Password:
Last successful login for root: Mon Aug 31 16:11:10 IST-5:30 2009 on pts/ta
Last unsuccessful login for root: Tue Jul 21 12:01:45 2009 on pts/0


When I connect to the console login I am getting the below mentioned error
current audit file size is 613959 kilobytes!!!
an attempt to switch to the backup file failed.
Must specify a backup file now !
audit file has 0% free space left !

I know how to deactivate the audit logging... But the PROBLEM is I COULD NOT LOGIN TO THE SYSTEM.

Please suggest a way to overcome this issue.

Thanks

Regards
Kasi

[Mark S Meadows]

Hi,

Where do your audit log file reside ?

I would check to see if the root file system "/" on the affected system is full :

# bdf /
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 1048576 370008 673296 35% /

and if so free up some space, temporarily if necessary.

Regards,

Mark

[Kasi_1]

As I mentioned in my post,the problem is I couldn't login to the system by any means to do certain activities.

Not thru telnet, ssh, direct console login...

Please suggest

[Mark S Meadows]

Hi,

I thought from the extract that you were able to access as root - apologies.

How about ftp, can you connect via this or remsh and see if you can free up any space, i.e. clear down the primary audit file that has filled up the file system.

In the worse case the syetem will have to be shutdown and rebooted into single user mode in order to free up space.

Regards,

Mark

[Duncan Edmonstone]

> A week back I activated audit logging.

And no doubt left everything at the defaults, which means you will get a LOT of audit data and that will be written into a logfile in your root filesystem (usually into /.secure/etc)

So now your root filesystem is full... if you can't get in to move this file off somewhere else, you are probably looking at a reboot and single user mode to resolve.

I'd then recommend that you turn off auditing until you have fully read this section of a sysadmin manual here:

http://docs.hp.com/en/B2355-90950/ch08s09.html

Particularly the section entitled "Guidelines for Administering Your Auditing System"

HTH

Duncan

[Kasi_1]

Thanks Mark and Duncan.

I am able to login now. I logged in with the single user mode and deleted the file in /.security/etc/audfile1 and audfile2.

Also I disabled the audit logging.

Thanks

Regards
Kasi

[Kasi_1]

thread closed.

[Mark S Meadows]

Hi Kasi,

I would advise amending the current auditing default settings if you have not already so that you do not encounter this problem in the future.

Look at having the log files under a separate file system, i.e. :

PRI_AUDFILE=/var/.audit/audfile1
SEC_AUDFILE=/var/.audit/audfile2

Please see /etc/rc.config.d/auditing and refer to the link above.

Regards,

Mark