In a trusted system the audnames file is either currupted or missing.

[Sean Kuruvilla]

I have a HPUX server running HPUX 11.0.B. The system is a trusted system and auditing has been turned on. It seems that the audnames files is missing now. So auditing has failed and the users are not able to log into the server either due to that. The system is not re-creating the file either when I asked it to. What can I do to re-create this file manually and get my system up and running.

[Paul Sperry]

audsys [ -nf] [-c file - s cafs] [-x file - z xafs ]

Turn on the auditing system. The system uses existing "current" and "next" audit files
unless others are specified with the -c and -x options. If no "current" audit file exists
(such as when the auditing system is first installed), specify it by using the -c option.

[Sean Kuruvilla]

Thank you for your response when I do that I get the following error. warning: cannot read badly formatted /.secure/etc/audnames
-c must be specified to select a current file. auditing system unchanged.

What I need to do now is change the system from an trusted system back to an non audited system or allocate more space to the root directory. When I do a bdf it is at 100% usage. So I need to clear up space. Becuase of this issue my users can not log into the box.

[Don Wilt]

Turn auditing off, if you don't have a seperate filesystem for .secure go and create one so you don't fill up root. Go into Auditing in SAM and select 'audited events' and SAM will re-create the audnames file for you.

[Miguel Suazo]

Another idea, just add two new audfile on a different filesystem. You don't have to switch audit off

audsys -x /other_filesystem/audfile_1 -z 102400
audsys -x /other_filesystem/audfile_2 -z 102400

After that you will be able to delete or move your current audit file in order to free up root filesystem space.