auditing and cron files

[Marcie Sirbaugh]

I am trying to set up auditing on my server, however when I do my crons stop working. It appears that I have the latest patch applied (PHCO_27141), however, I still recieve the following message:

"Cron: Your job did not contain a valid audit ID."

Any suggestions??

[Pete Randall]

Marcie,

I haven't got an answer but I believe I can narrow the cause. Quoting from "man 5 audit":

"Self-auditing Programs
To reduce the amount of log data and to provide a higher-level
recording of some typical system operations, a collection of
privileged programs are given capabilities to perform self-auditing.
This means that the programs can suspend the currently specified
auditing on themselves and produce a high-level description of the
operations they perform. These self-auditing programs include: at(1),
chfn(1), chsh(1), crontab(1), login(1), newgrp(1), passwd(1),
audevent(1M), audisp(1M), audsys(1M), audusr(1M), cron(1M), init(1M),
lpsched(1M), pwck(1M), and sam(1M). Note that only these privileged
programs are allowed to do self-auditing, and that the audit
suspension they perform only affects these programs and does not
affect any other processes on the system."


The fact that cron is one of these "self auditing programs" would seem to be the source of your issue here.


Pete

[Pete Randall · Accepted solution]

Here's a thread which addresses this question:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xc5f2f841489fd4118fef0090279cd0f9%2C00.html&admit=716493758+1068137209654+28353475


Pete

[Pete Randall]

And another:

http://forums1.itrc.hp.com/service/forums/parseCurl.do?CURL=%2Fcm%2FQuestionAnswer%2F1%2C%2C0xc5f2f841489fd4118fef0090279cd0f9%2C00.html&admit=716493758+1068137209654+28353475


Pete

[doug hosking]

Converting to a trusted system AFTER installing PHCO_28980 should fix the problem.
No cron patch will be able to help, nor will installing the tsconvert patch without rerunning the tsconvert. (The bug fixed in the patch caused cron's database of audit IDs to not be fully populated during the original conversion to a trusted system.)