From: WGregory (wgregory@cox.net)
Date: Tue Sep 19 2006 - 22:41:03 EDT
I recently converted an old HPUX 10.20 legacy system to trusted mode and
turned auditing on. I have to keep the old (non-supported) 10.20
running for another 6-12 months before the new system is ready.
During sam conversion, the primary and alternate audit files were set up
in the default location of /.secure/etc. Initially, everything worked
ok. Using audsys in a cron-run script, I was able to switch the primary
audit file to a different new file in /.secure/etc each day for over a
week.
Today, I tried to change the location of the primary audit file to a
directory (/Audsys/TCB) on a separate file system - /etc/fstab entry =
"/dev/vg00/lvol4 /Audsys hfs nosuid 0 2". /Audsys and /Audsys/TCB are
owned by root, permissions=700.
When I issue the command "audsys -c /Audsys/TCB/[new filename] -s
10000", I get an error message : "insufficient space available on audit
file filesystem". However, bdf shows there is over 3 GB free on this
file system. I am not using it to store any other data at present.
Trying to debug the problem, I edited /etc/fstab and changed the nosuid
option back to "defaults", edited the /etc/rc.config.d/auditing file and
changed the location of the audit files (PRI_AUDFILE and SEC_AUDFILE)
to /Audsys/TCB; however, when I rebooted I got the same error message
when I tried to switch the audit file location.
I can't find anything in HP documentation that prohibits the audit files
from being located in a separate filesystem. Indeed, the documentation
recommends it.
Any thoughts or ideas appreciated.
Willis Gregory
wgregory@cox.net
--
---> Please post QUESTIONS and SUMMARIES only!! <---
To subscribe/unsubscribe to this list, contact majordomo@dutchworks.nl
Name: hpux-admin@dutchworks.nl Owner: owner-hpux-admin@dutchworks.nl
Archives: ftp.dutchworks.nl:/pub/digests/hpux-admin (FTP, browse only)
http://www.dutchworks.nl/htbin/hpsysadmin (Web, browse & search)
This archive was generated by hypermail 2.1.7 : Sat Apr 12 2008 - 11:02:54 EDT