root file system full

[OzTEXS]

Hi,

Iam using C3000 Class workstations running HP-UX 11.0. In the /.secure directory I have a log file the keeps growing then crashing my system. I just want to find out if I can have the file saved in another directory, instead of the root file system.

The files in question are audit files, but when i try and change the location via Sam, it disallows it.

Any ideas ?

[Michael Tully · Accepted solution]

You could try and turn off the auditing whilst you create a different place in which to place the logs. You want to be able to change the location whilst the processes are still active. My suggestion is that you create another directory and create a symbolic link between and /.secure and it, if you can't get SAM to create a different location for the log.

[Bill Hassell]

As mentioned, this is auditing and you will need massive logfile space for these logs. Look at the man page for audsys. You can't use the root filesystem even though that is the default location. Run SAM and turn off all auditing. Then remove /.secure and all directories and files below it. Now locate a filesystem such as /var that has plenty of space (dozens of megs). Create a directory, something like /var/tmp/audit-logs. Then create a symlink: ln -s /var/tmp/audit-logs /.secure. Now you can re-enable auidting in SAM.

NOTE: It is very easy to generate hundreds of megs of auditing logs if you select too many things to track. Limit your auditing to the required items, or get a 36Gb disk or larger to hold all the data. Note that massive logging will slow down your overall system response.

[OzTEXS]

Thanks for info guys. All is well now.

Cheers,
OZ