LAUS/cron errors on RedHat AS 3.0

[TJ_16]

We decided to stop the audit process due to the ridiculous size of the log files it kept. To stop, I just did:
rpm -e laus, checked to make sure the audit process was gone and rm -rf /var/log/audit*.

Now, since doing that I get the following errors in my /var/log/cron file:
CROND[23053]: LAuS error - do_command.c:182 - laus_log: (19) laus_log: No such device

I am not 100% sure, but it seems to follow the /usr/lib/sa/sa1 1 1 cron.d job.

Any ideas?

I tried to reload the audit module, reinstall the laus package, and put alias char-major-10-224 off in /etc/modules.conf.

Thanks

[Gopi Sekar]

it looks like laus left entry in the crontab which tries to execute at periodic intervals.

if you do not want laus then check /etc/cron.* directories for any file containing laus entry, if so remove the file and you should be safe.

you should also check in /etc/crontab file for this entry, if found remove it from there too.

Hope this helps,
Gopi

[John Poff · Accepted solution]

Hi,

I've got the same problem here. It looks like you also need to shutdown cron and atd, rmmod the audit kernel module, and then restart cron and atd.

Here is a link that I found in Bugzilla that explains it:

https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=136657

JP

[TJ_16]

I did stop the atd, crond, and syslog daemons, modprobe -r audit, then restarted those 3 processes. The audit module get reloaded by one of them and the erros will continue.

Were you able to get it to stop for you by doing this?

[Ivan Ferreira]

Verify if logrotate.conf is not trying to do some cleaup of the LAUS log files.

[TJ_16]

I think I got it...

The bugzilla report seemed to work, even though I thought I had did that already.

Thanks for all the responses.

[TJ_16]

add alias char-major-10-224 off to /etc/modules.conf
stop atd and crond
rmmod audit
start atd crond