Audit messages filling up system console

[Wojciech Furmankiewicz_1]

Hello,

I have a lot of useless messages filling up the system console every 10 seconds saying:
there is 70% space left on audit filesystem
The space tresholds are set to defaults (audomon command).
Does anybody know how to stop the messages ?

Thanks in advance for your help.
Wojtek

[Steven E. Protter · Accepted solution]

You have not set your system up to care whether there is 70% or 5% on the filesystem the audit files are in.

These messages are triggered because the audit file size you have set in the configuration is approaching full size or exceeding the maximum you set.

In /etc/.secure

You have a configuration file that will let you change the size of the files. Since you seem to have plenty of space, I suggest you choose a larger filesize and then the messages will stop going to the kernel.

Having cron copy and clear the files once in a while will also stop the console messages.

SEP

[Bill Hassell]

When you turn on auditing, it is very easy to create MASSIVELY large logfiles. The audit system default location is the / (root) filesystem, the WORST place ever for fast-growing logfiles. The program which is producing the messages in syslog is called audomon. Read the man page for audomon and audsys and then select a location in /var where there is enough space. Change the default file location for audsys as well as the size. You should not get the warning message once the location and size for switching are reasonable.

Note that it is very easy to audit so many events at the same time that our system will perform much slower and the logfiles may be hundreds of megs in just a day or two.

[Timothy Sullivan]

Just a minor clarification on Steven's post above (from 11 months ago!)

In hp-ux 11.11, the default location where the audit files will live and grow is /.secure/etc/ and not /etc/.secure/

I just had this issue occur on a brand new box I set up today. I ran Bastille and asked Bastille to turn auditing on as part of its configuration process.

When I returned from lunch, I found /dev/root full. The auditing system was the cause.

I temporarily turned off auditing using the command: audsys -f

Then, in /.secure/etc/ I deleted these two files:
audfile1
audfile2

Now, I'll reconfigure the auditing system so that it does not do this again.

Tim