i have the folloing messege on my console repeating instantly

[akademik]

current audit file size is 2286 kilobytes!!!
an attempt to switch to the backup file failed.
Must specify a backup file now !
and i cant log as su
$ su
Password:
Last successful login for root: Thu Aug 9 17:37:02 EET-2EETDST 2001
Last unsuccessful login for root: Tue Aug 7 19:30:37 EET-2EETDST 2001
Memory fault(coredump)
$
plz help
10x in advance

[David Navarro]

Can you login directly as root?
If not, you can boot as single user mode, then make changes or what you want to do.

[akademik]

i can login as root but i think that this messege audit file size is 2286 kilobytes!!!
an attempt to switch to the backup file failed.
Must specify a backup file now !
is the cause that su gives me segfault
i dont know how to fix that audit file
audsys gives me this
# audsys
auditing system is currently on
current file: /.secure/etc/audfile2
next file: none
statistics- afs Kb used Kb avail % fs Kb used Kb avail %
current file: 1000 2290 -128 147456 58847 60
next file: none
#
avail % -128 ?
how can i fix this ?
10x in advance

[Deshpande Prashant]

HI
Use audsys -c /.secure/etc/audfile3 to switch auditing to a new file.
Then check your audit file settings with audsys command. you may want to increase it with command #audsys -s

Thanks
Prashant Deshpande

[Christopher McCray_1]

if you can, log directly into the console as root. If it is taking to long to do so, your file system on which you audit files are being written is full; in this case do the following:

# audsys -f (stops auditing and frees up your processors)
# gzip (or mv it somewhere else first if you don't have enough space)
# audsys -n -c -s

after this, check out the system for any problems which may be causing auditing to go nuts. Where I work, we create a separate file system (/audit) to dump audit files and have it about 1GB; just something to think about.

Hope this helps
Chris

[Ravi_8]

Hi, akademic
you can change to another file
#audsys -x file.

[Christopher McCray_1]

Just two more things:

1. you must either specify the directory path in conjunction with the file name, or be in the directory when you run the audsys commands, or else audsys will assume you mean to create the file in your pwd.

2. you might want to specify a larger size for you audit file size; 2000Kb is rather small. You can change the size of the audit file on the fly by only specifying the -c (current file size) or -z (next file size) with audsys.

[Mark Vollmers]

One quick note. Don't forget to dump the core file. It probably isn't causing you additional problems, but they can fill up a filespace quickly.

Mark

[Magdi KAMAL]

Hi akademik,

#audsys -s cafs
Specify cafs, the current audit file switch size in KB.

#audsys -x file
Specify the next audit file, any existing next file is replaced with the file specified. The specified file must be empty or nonexistant. Unless it is the current or next file already in use by the auditing system.

#audsys -z xafs
Specify xafs, the next audit file switch size in KB.

Magdi