Login or Register to Ask a Question and Join Our Community


UNIX for Dummies Questions & Answers

Auditd problem

 
Thread Tools Search this Thread
Top Forums UNIX for Dummies Questions & Answers Auditd problem
# 1  
Old 11-20-2009
Auditd problem
Hi,

I have the following my logs:

Code:
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4273 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4274 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded
Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4275 audit_rate_limit=0 audit_backlog_limit=320
Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded

What do I do to fix this problem? Please provide a careful explanation as I am new to auditd.

Thanks
 
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Shell Programming and Scripting

Script to update rsyslog.conf and auditd.conf

Hello all, Newbie here. I'm currently tasked with updating rsyslog.conf and auditd.conf on a large set of servers. I know the exact logging configurations that I want to enable. I have updated both files on on a server and hope to use the updated files as a template for the rest of the... (3 Replies)
Discussion started by: Mide
3 Replies

2. Shell Programming and Scripting

Trying to customize auditd.cron

Hello all, I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different... (2 Replies)
Discussion started by: cdlaforc
2 Replies

3. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

4. UNIX for Dummies Questions & Answers

Auditd (How to disable)

I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily! I didn't install that and don't know why it's started magically for some reason. Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Discussion started by: HiphopTech
2 Replies

5. Cybersecurity

Events done on the serial console does not get recorded via the auditd

the events done on the serial console does not get logged. I am using BSM audit. I have enabled all audit flags. Is there anything that im missing? Please help!! (2 Replies)
Discussion started by: chinchao
2 Replies

6. Red Hat

Auditd event cache

I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit. After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue. When running as a user, the events are only spit out by the dispatcher (and... (0 Replies)
Discussion started by: tahoekid
0 Replies

7. AIX

user login problem & Files listing problem.

1) when user login to the server the session got colosed. How will resolve? 2) While firing the command ls -l we are not able to see the any files in the director. but over all view the file system using the command df -g it is showing 91% used. what will be the problem? Thanks in advance. (1 Reply)
Discussion started by: pernasivam
1 Replies

8. Linux

sending messages from auditd logs to syslog server

I have the auditd running and I need to send the audit logs to a remote syslog server. Anyideas on how to do that? (1 Reply)
Discussion started by: jmathenge
1 Replies

9. Red Hat

auditd

Has anyone used, or set up auditd? I want to use it to audit critical system files. Will this be hard, how would I start setting this up? :eek: (2 Replies)
Discussion started by: syndex
2 Replies

10. UNIX for Dummies Questions & Answers

how to disable auditd daemon

I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Discussion started by: skumar11
2 Replies
Login or Register to Ask a Question

LEARN ABOUT DEBIAN

paps

PAPS(1) 						      General Commands Manual							   PAPS(1)

NAME

       paps - UTF-8 to PostScript converter using Pango

SYNOPSIS

       paps [options] files...

DESCRIPTION

       paps reads a UTF-8 encoded file and generates a PostScript language rendering of the file. The rendering is done by creating outline curves
       through the pango ft2 backend.

OPTIONS

       These programs follow the usual GNU command line syntax, with long options starting with  two  dashes  (`-').   A  summary  of  options	is
       included below.

       --landscape
	      Landscape output. Default is portrait.

       --columns=cl
	      Number of columns output. Default is 1.
	      Please notice this option isn't related to the terminal length as in a "80 culums terminal".

       --font=desc
	      Set the font description. Default is Monospace 12.

       --rtl  Do right to left (RTL) layout.

       --paper ps
	      Choose paper size. Known paper sizes are legal, letter and A4. Default is A4.

       Postscript points
	      Each postscript point equals to 1/72 of an inch. 36 points are 1/2 of an inch.

       --bottom-margin=bm
	      Set bottom margin. Default is 36 postscript points.

       --top-margin=tm
	      Set top margin. Default is 36 postscript points.

       --left-margin=lm
	      Set left margin. Default is 36 postscript points.

       --right-margin=rm
	      Set right margin. Default is 36 postscript points.

       --gutter-width=gw
	      Set gutter width. Default is 40 postscript points.

       --help Show summary of options.

       --header
	      Draw page header for each page.

       --markup
	      Interpret the text as pango markup.

       --lpi  Set the lines per inch. This determines the line spacing.

       --cpi  Set the characters per inch. This is an alternative method of specifying the font size.

       --stretch-chars
	      Indicates  that  characters  should be stretched in the y-direction to fill up their vertical space. This is similar to the texttops
	      behaviour.

AUTHOR

       paps was written by Dov Grobgeld <dov.grobgeld@gmail.com>.

       This manual page was written by Lior Kaplan <kaplan@debian.org>, for the Debian project (but may be used by others).

								  April  17, 2006							   PAPS(1)