HP-UX Reference (11i v2 03/08) - 1M System Administration Commands A-M (vol 3)

audsys(1M) audsys(1M)

WARNINGS

All modiﬁcations made to the audit system are lost upon reboot. To make the changes permanent, set

AUDITING, PRI_AUDFILE, PRI_SWITCH, SEC_AUDFILE, and

SEC_SWITCH in

/etc/rc.config.d/auditing

A user process will be blocked in the kernel if all of the following events occurs:

• the ﬁle system containing current audit ﬁle is full,

• there is no next audit ﬁle or the next audit ﬁle is removed, and

• the user process makes an auditable system call or generates an auditable event.

To recover from the resulting deadlock, the session leader of the console is killed so that the the adminis-

trator can login. Hence sensitive applications should not be run as session leaders on the console.

AUTHOR

audsys was developed by HP.

FILES

/.secure/etc/audnames

File maintained by audsys

containing the "current" and "next" audit

ﬁle names and their switch sizes.