Audit File Size Error

[Mark Gibson_6]

I am getting the message...
"current audit file size is xxxxx kilobytes.
An attempt to switch to the backup file failed.
Must specify a backup file now!" ...
about every 30 seconds on my HP-UX server. Can someone please tell me where to go to change the audit files? I am a new UNIX user and I have not seen this error message before.

[RAC_1]

check the file system where you store the audit file. Also look at the kernel tunables acctresume and acctsuspend which control the sizes when accounting will stop and resume.

Anil

[David Child_1]

Mark,

Perhaps you do not have a 'next' audit file to switch to. Run the following to check your current settings:

# audsys
auditing system is currently on
current file: /var/adm/logs/audit/audfile1
next file: none
...

If there is no 'next file' then the system cannot switch it. Do something like the following to set it up if this is the case:

# audsys -f
# mv /var/adm/logs/audit/aud* /var/adm/backups
# audsys -n -c /var/adm/logs/audit/audfile1 -s 10240 -x /var/adm/logs/audit/audfile2 -z 10240

Check the man page for audsys for details. Also, once it switches to audfile2 you no longer have a 'next file'. It is best to write a script to automate the log maintenance.

David