Login or Register to Ask a Question and Join Our Community


Solaris

help with audit_warn

Login to Discuss or Reply to this Discussion in Our Community

 
Thread Tools Search this Thread
Operating Systems Solaris help with audit_warn
# 1  
Old 02-18-2008
help with audit_warn
hi everyone i have this error in the console but i dont have any idea about wath is the problem anyone can help me please

the msj is

/etc/security/audit_warn: Hard limit exceeded on all filesystems
# 2  
Old 02-18-2008
You have a quotes settings on your filesystems.
Use command quota for research this question.
Quotes may be soft and hard, and your message tell you what hard quote is limit exceeded on all filesystems
# 3  
Old 02-18-2008
You are probably getting large numbers of alerts sent to /var/adm/messages

A stop/start of the auditd process may well be required:
Code:
Solaris 9
# /etc/rc2.d/S99audit stop

Solaris 10
# svcadm disable svc:/system/auditd:default

Check it's down / then restart it:
Code:
 Solaris 9
# /etc/rc2.d/S99audit start

Solaris 10
# svcadm enable svc:/system/auditd:default

Make sure you're not getting the messages anymore.
Code:
% tail -f /var/adm/messages

Check free space on root file system.
Code:
% df -k /

clear down your messages files if required e.g.
Code:
cat /dev/null > /var/adm/messages

HTH,
# 4  
Old 02-19-2008
thanks i go and check ufs / , i have other cuestion , can i change the hard limit value to increase and avoid the messages .

thanks a lot
Login or Register to Ask a Question

Previous Thread | Next Thread
Login or Register to Ask a Question