Security Audits Constant Issue - Root Partition Very Small /.secure/etc /audfile2

[J McCarthy]

The person who installed our HP-UX system made the root partition way to small.  The system is constantly preventing users from succesfully logging in since the root drive partition is getting full. Since the drive is getting full I've been lucky enough to have users still logged in when it happens, otherwise new users are reject when they attempt to login. Existing users who are logged in are able to su to root and clear up the space.  My concern is at some point I will not be lucky.  The last time I attempt to console in via serial and from the menu I selected SE (to get into the OS) and I was rejected, somthing about the host not found sorry I don't remember.  When I attempted to enter the console monitor, the response was drive full backup of audit file to a different path, it kept say this over and over in a rotating script and no matter what I could not get it to stop and could not return to the conolse menu screen (evern after a reboot of my Hypterterm computer and using a different Hyperterm computer).  If I got into SAM and redirect the audit2 file to write to a mounted RAID drive (as oppose to the default location) will this break my system or prevent auditing?

A million thanks,

John

[Patrick Wallek]

That is exactly what you  need to do.  The audit files should be written to a location other than '/'. This is the default likely because the '/' directory is also root's home directory.

You should modify auditing so that the audit files are written to a different location.  Once you do this I have a feeling that your problems with '/' filling up will go away.

[J McCarthy]

Will perform tommorrow and update all.  A millon thanks,
John