C2 level Auditing log error? (HPUX Trust System)

[stone313]

Question:Display auditing log error!!

audisp: cannot back-reference pid ident. information.

============================================
# audisp /.secure/etc/audfile1
All users are selected.
All events are selected.
All ttys are selected.
Selecting successful & failed events.
TIME PID E EVENT PPID AID RUID RGID EUID
EGID TTY

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~
audisp: cannot back-reference pid ident. information.
#

[Proboi]

Stone,
It looks like the audit files MAY_have_got corrupted usually because it is trimmed/switched without using "audsys" commands

lehai got the EXACT MESSAGE -> please check this forum

http://forums13.itrc.hp.com/service/forums/questionanswer.do?admit=109447627+1240941896591+28353475&threadId=1034502

[stone313]

Hi Proboi,

Thanks for your reply and I am trying.

[Steven E. Protter]

Shalom,

The file system the audit logs are being written to is root. Root does not have enough space for the logs but its the default.

You probably just ran out of space.

Relocate the audit logs to a mounted file system with a few GB of space.

SEP