Audit logs

[Srinivas_3]

Actually my system has Informix running on it. We have converted one of our HPUX 11.0 system to trusted system. The same system has informix 9.21 running on it. Now the audit log shows event type 'kill', event number 37 and owner informix. This message in the audit log repeats for every 1sec. So this fills out the audit log very badly.

Any idea, what the event means? Also please point me to the right documentation for audit logs where we can debug the event types etc.

HPUX 11.0
Informix 9.21
L Class

[Animesh Chakraborty]

This may give you some idea

http://docs.hp.com/cgi-bin/fsearch/framedisplay?top=/hpux/onlinedocs/B2355-90742/B2355-90742_top.html&con=/hpux/onlinedocs/B2355-90742/00/00/67-con.html&toc=/hpux/onlinedocs/B2355-90742/00/00/67-toc.html&searchterms=logs%7caudit&queryid=20021015-230143

[doug hosking]

System call 37 is the 'kill' system call.
(grep -i sys_kill
/usr/include/sys/scall_define.h)

While I don't know about the internals of informix, I can make a guess. Using kill(2) with a signal number of 0 is a convenient way of testing non-destructively to see if another process still exists. (See the kill(2) manual
page.) I would guess that a process is polling once a second to see if another process has died, and, if so, would restart it or do some similar cleanup.

/usr/include/sys/audit.h has some information on audit record types, but this information is subject to change between releases.

[Darren Prior]

Hi,

In you are not interested in seeing this message then you could consider using audevent to turn off that event. I'd make sure that you know why it's happening first though :)

regards,

Darren.