audisp seems to hang

[MTSU_SAN]

Whenever I run audisp, it seems to hang, and show me varying information. Sam will show me the whole log, if I manually kill the audisp process (!?), but running it on the command line, it only shows me parts. I saw no patches later than mine, except on released last month. Anybody else have these problems?

[Jeff Schussele]

Hi Jerry,

How are you calling the data?
Are you narrowing it down to user, tty, event, failed, successful, etc?
If you're calling the whole audit log, that could take some time.

If SAM can display it all OK, then I'd look in SAM's log (/var/sam/log/samlog) to see the command SAM uses to do it.

Rgds,
Jeff

[S.K. Chan]

Have you got this patch installed .. ?
For 11.00 => PHKL_28445
For 11.11 => PHKL_28446
They are the sudit subsystem cumulative patch.

[MTSU_SAN]

No, I do not have the latest patch, because it just came out last month. I would think someone would have run into this problem, if that is the solution (and I read the patch text, it doesn't mention a hang). And, no, Sam cannot display it properly, either. It hangs, too.

[Darren Prior]

Hi Jerry,

What size are your log files? Is it possible to move the existing audit logs and start with fresh logs in case there's some corruption in the existing files?

If this is something that's only just stopped working, can you pinpoint any changes that may have had an effect on it?

regards,

Darren.

[MTSU_SAN]

I've only just started setting it up--I don't know if my predecessor ever got it working, or tried, and that would have been years ago. So, I started with fresh files (twice, now).

[doug hosking]

Jerry, I work in the team at HP that owns the audisp code. If you're willing to share a sample of an audit trail that demonstrates this behavior (either by making it available through ftp or by passing it to me through your HP representative, depending on how sensitive the data is) and tell me what HP-UX release you are running, I'd be willing to take a look at it. I don't recall seeing this problem before and would be interested in finding out what's happening in your case.