System Administration
cancel
Showing results for 
Search instead for 
Did you mean: 

vmunix: The current audit file is switched from /.secure/etc/audfile1 to /.secure/etc/audfile2

 
John Ivy
Frequent Advisor

vmunix: The current audit file is switched from /.secure/etc/audfile1 to /.secure/etc/audfile2

I am receiving this message from one of my backup servers(vmunix: The current audit file is switched from /.secure/etc/audfile1 to /.secure/etc/audfile2). The log is filling up and I was trying to determine what is failing that is filling up the log. I have been using sam to look at the audit logs. Is there a break down on how to read the audit logs in sam? Any help would be appreciated. Thanks
2 REPLIES
Mark S Meadows
Valued Contributor

Re: vmunix: The current audit file is switched from /.secure/etc/audfile1 to /.secure/etc/audfile2

Hi John,

The audit files are in binary.

You can use the following commands to query the logs :

audisp /.secure/etc/audfile1

or

audisp -f -u wlsuser /.secure/etc/audfile1 |more

I hope this helps.

Regards,

Mark
Administrating HP-UX systems for more years than I care to admit, but still enjoying it (most of the time!).
John Ivy
Frequent Advisor

Re: vmunix: The current audit file is switched from /.secure/etc/audfile1 to /.secure/etc/audfile2

Thanks I am actually looking for a discription or break down of the individual items kind of like a spread sheet.
Thanks again