Bad Audit Flag

[Vidhya B]

Hi all,

When I tried login as root, I got the message "Bad Audit Flag". Its a trusted system. When I observeed the /tcb/files/auth/r/root file, I found below two lines missing.
:u_auditid#0:\
:u_auditflag#1:\

I was able to login once I placed these lines from another server root file.
Can anyone tell me what are those lines do exactly?
What are the numbers 0 and 1 in those lines exactly say? Because when I saw the password file of another user one of those numbers were different.

Kindly help me in understanding this.
Thanks in Advance!!!

[Ajin_1]

Hi

http://h30499.www3.hp.com/t5/System-Administration/bad-audit-flag/m-p/2526208#M24384

Regards
Ajin.S

[Vidhya B]

Hi,

Yea I have checked it.

In one of my system, I checked the auditid for a user. It was 48 in the password file. But in the /etc/passwd, It was in line number 38.

Kindly help!!!

[rariasn]

Hi:

The audit id is stored within /tcb which is not present on a non-trusted system.

u_audid This field contains the audit ID for the user.

u_auditflag This field contains the audit flag for the user.

man prpwd

if auditing system is off is the same:

u_auditflag#1:\
u_auditflag#0:\

man audit

rgs,

[Vidhya B]

Hi,

Thanks for your replies.

If these lines are found missing for any other user and due to which if i am not able to login, How will I be able to add these lines for tat particular user.

I will boot the server in single user mode. But where I can refer what's the audit if of the user.

Kindly help.

[Vidhya B]

Hi,

What is the advantage of turning on the audit?

Is there any disadvantage if I turn off even?

As per my understanding, these entries will be there only if the audit is on?

Please help me in understanding!!!