System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

Audit file has 0% free space left !

Kasi_1
Advisor

Audit file has 0% free space left !

I have an issue with one of my HP server. We are having HP-UX 11.23. A week back I activated audit logging. Now when I try to login to the HP UX server from remote I am getting the following error

login: root
Password:
Last successful login for root: Mon Aug 31 16:11:10 IST-5:30 2009 on pts/ta
Last unsuccessful login for root: Tue Jul 21 12:01:45 2009 on pts/0


When I connect to the console login I am getting the below mentioned error
current audit file size is 613959 kilobytes!!!
an attempt to switch to the backup file failed.
Must specify a backup file now !
audit file has 0% free space left !

I know how to deactivate the audit logging... But the PROBLEM is I COULD NOT LOGIN TO THE SYSTEM.

Please suggest a way to overcome this issue.

Thanks

Regards
Kasi
7 REPLIES
Mark S Meadows
Valued Contributor

Re: Audit file has 0% free space left !

Hi,

Where do your audit log file reside ?

I would check to see if the root file system "/" on the affected system is full :

# bdf /
Filesystem kbytes used avail %used Mounted on
/dev/vg00/lvol3 1048576 370008 673296 35% /

and if so free up some space, temporarily if necessary.

Regards,

Mark
Administrating HP-UX systems for more years than I care to admit, but still enjoying it (most of the time!).
Kasi_1
Advisor

Re: Audit file has 0% free space left !


As I mentioned in my post,the problem is I couldn't login to the system by any means to do certain activities.

Not thru telnet, ssh, direct console login...

Please suggest

Mark S Meadows
Valued Contributor

Re: Audit file has 0% free space left !

Hi,

I thought from the extract that you were able to access as root - apologies.

How about ftp, can you connect via this or remsh and see if you can free up any space, i.e. clear down the primary audit file that has filled up the file system.

In the worse case the syetem will have to be shutdown and rebooted into single user mode in order to free up space.

Regards,

Mark
Administrating HP-UX systems for more years than I care to admit, but still enjoying it (most of the time!).
Duncan Edmonstone
Honored Contributor

Re: Audit file has 0% free space left !

> A week back I activated audit logging.

And no doubt left everything at the defaults, which means you will get a LOT of audit data and that will be written into a logfile in your root filesystem (usually into /.secure/etc)

So now your root filesystem is full... if you can't get in to move this file off somewhere else, you are probably looking at a reboot and single user mode to resolve.

I'd then recommend that you turn off auditing until you have fully read this section of a sysadmin manual here:

http://docs.hp.com/en/B2355-90950/ch08s09.html

Particularly the section entitled "Guidelines for Administering Your Auditing System"

HTH

Duncan

HTH

Duncan
Kasi_1
Advisor

Re: Audit file has 0% free space left !

Thanks Mark and Duncan.

I am able to login now. I logged in with the single user mode and deleted the file in /.security/etc/audfile1 and audfile2.

Also I disabled the audit logging.

Thanks

Regards
Kasi

Kasi_1
Advisor

Re: Audit file has 0% free space left !

thread closed.
Mark S Meadows
Valued Contributor

Re: Audit file has 0% free space left !

Hi Kasi,

I would advise amending the current auditing default settings if you have not already so that you do not encounter this problem in the future.

Look at having the log files under a separate file system, i.e. :

PRI_AUDFILE=/var/.audit/audfile1
SEC_AUDFILE=/var/.audit/audfile2

Please see /etc/rc.config.d/auditing and refer to the link above.

Regards,

Mark



Administrating HP-UX systems for more years than I care to admit, but still enjoying it (most of the time!).