Just plain funny. 11.11 auditing and AUDEVENT_ARGS4

[Court Campbell]

I will try to make this story as short as possible. We have some production servers still running 11.11. We have auditing on because of some SOX controls that someone came up with. Anyway, we disabled some of the audits on syscall's like semop, etc. So to do this we edited the file /etc/rc.config.d/auditing and added the appropriate arguments that go to AUDEVENT_ARGS4. Well after a reboot it was found that the system was still auditing semop syscall's. So I looked and found that the if statement for AUDEVENT_ARGS4 in /sbin/init.d/auditing was missing. so it was only processing AUDEVENT_ARGS[1-3]. The dates on the files are from Nov 2000 and we only got the systems in 2004. So I believe this to be a bug and not something a former sysadmin did. I also noticed mo mention of AUDEVENT_ARGS4 in the config file /etc/rc.config.d/ auditing. To double check this I got on a 11.23 box and the two files made reference to AUDEVENT_ARGS4. Anyway to fix the issue you (if you also have the problem) is to add the following to /sbin/init.d/auditing:

if [ "$AUDEVENT_ARGS4" ]; then
eval `echo /usr/sbin/audevent $AUDEVENT_ARGS4`
set_return
fi

[Pete Randall]

Sorry, Court, but I've got to say that you have one strange sense of humor.

;^)


Pete

[Court Campbell]

It's really only funny because it's 2008 and this just came up.

[Pete Randall]

Yeah, I'm just picking on you.

Zero, please.


Pete

[Court Campbell]

...

[TwoProc]

I think Pete's only problem was differentiating between "funny strange" and "funny haha"...

Ha! < but not out of chair >

:-)

[Court Campbell]

TwoProc,

Here are some assumptions I came up with after noticing this:

1. No one uses auditing. (not true)
2. No one uses 11.11 anymore. (definitely not true)
3. I am the only one with this issue. (Likely)
4. No one else disables any of the auditing. (Not likely)
5. Everyone else besides me writes there audit data to a really large disk. (Possible, also depends on what is being audited)

i am sure that can be added to this list.

[TwoProc]

6) Only me, you and Pete bother to post to funny threads. And even more so to their funny/unfunny responses.

[Court Campbell]

I guess so.


To go off on another tangent. I wish the forums allowed edits of responses. I hate it when I go back and notice that I missed a word in a sentence, or just plain misspelled something.

[TwoProc]

Court -

Re: editing for posts:
I'm pretty sure I know how to fix that.

This is covered in a config file on the forums server hosting forums.itrc.hp.com.

If we could get them to look in /etc/rc.config.d/posting - there's an argument array called POSTEVENT_ARGS4.

Unfortunately , if we look in the file
/sbin/init.d/posting...

:-) :-) :-)

[Dennis Handly]

>I wish the forums allowed edits of responses.

If this is real important, you could create another reply with the corrections and ask the moderators to delete the bad one:
http://forums.itrc.hp.com/service/forums/questionanswer.do?threadId=1189173