Emailing administrator when auditing fails

[Jim Poplawski]

Folks,
Is there a way to have the auditing system on HPUX e-mail an administrator (or group of admins) when something significant happens with auditing? (e.g. switch to second file, auditing file system full, auditing stopped/started). Or do we need to write something to monitor syslog and then e-mail when it spots one of these things? I'm running HP-UX 11.23 in trusted mode.
thanks
Jim

[Steven E. Protter]

Shalom,

Have the audit done via as script.

rc=$?

if [ $rc -ne 0 ]
then

fi

SEP

[Jim Poplawski]

That might give me the actual starting and stopping of the audit script, but I was looking for an e-mail notification when the auditing subsystem switched to a new audit file because the primary filled up, or if the audit file system filled up. I don't see any options to put on audmon to do that.
thanks
Jim