Audevent

[Belinda Dermody]

I just started my audevent on my HPUX 11i to conicide with my running of tripwire. I see where I can define audfile2 and a switch over file when the audfile2 fills up, but what happens when my secondary file fills up which I have defined as audfile2a. The max I could put in the window was 99,000,000 for both files. I created a 1.5 gig lvol. I have it running now for about 3 hours and it has already written 16m of data.

[Steven E. Protter · Accepted solution]

Please provide a copy of your audit file configuration. Then someone can recommend a change to stop this behavior.

You can also write a script to force a log change and write off the old logs to tape or some other form of storage. This option worked well for me in the past.

SEP

[Belinda Dermody]

AUDITING=0
PRI_AUDFILE=/.secure/etc/audfile2
PRI_SWITCH=80000
SEC_AUDFILE=/.secure/etc/audfile2a
SEC_SWITCH=80000