audsys behaviour

[Mauro Gatti]

Hi all,
I'm trying to understand audsys behavior while it writes on audit file.

# audsys
auditing system is currently on
current file: /var/audit/audfile.200811031620
next file: none
statistics- afs Kb used Kb avail % fs Kb used Kb avail %
current file: 10240 111492 -988 14614528 2685232 82
next file: none

Why does available space on file is negative?
Shouldn't audomon stop to log when audit file reaches its maximum or this is true only if there is set also the "next" audit file?

Thank You

Regards

Mauro

[WayneHP · Accepted solution]

It means you are OVER the afs defined value of 10240 by 988% a log switch shoudl have occured.

Look in logs you will see messages ask for the next file.

What version of HP-UX?

[Steven E. Protter]

Shalom,

This means log rotation has failed and the file has exceeded the maximum size set in the trusted system configuration file.

Time to manually rotate the files and look at the logs to find out why automated log rotation has failed.

SEP

[Mauro Gatti]

Thank You