Re: audit warning?
Re: audit warning?
- Subject: Re: audit warning?
- From: Stacey Son <email@hidden>
- Date: Thu, 10 Dec 2009 22:13:28 -0600
On Dec 10, 2009, at 5:27 PM, Godfrey van der Linden wrote:
> Probably the wrong list, but darwin-dev seems to have died and the cocoa lists aren't really the right place either.
>
> Saw these few lines go past in my secure.log yesterday. I don't recognise them and I'm a bit concerned. Can anybody out there explain them?
>
> Dec 10 19:47:13 [snipped] [ loginwindow[38]: in pam_sm_authenticate(): Failed to determine Kerberos principal name.
> Dec 10 19:47:14 [snipped] [9430]: audit warning: allsoft
These warning messages are generated by auditd...
The above indicates that the soft (disk space) limit for all filesystems has been exceeded. Your system is running low on disk space.
> Dec 10 19:47:14 [snipped] [[9431]: audit warning: soft /var/audit
The above indicates that the soft limit for this directory has been exceeded.
> Dec 10 19:47:14 [snipped] [[9433]: audit warning: closefile /var/audit/20091208225521.20091210084714
The above indicates that a trail file has been closed, so can now be post-processed. After the audit log gets larger than a certain size (see /etc/security/audit_control) auditd will close the trail file and open a new one.
For more information see auditd(8), audit_warn(5), and audit_control(5). You may want also see the documentation on trustedbsd.org: http://www.trustedbsd.org/docs.html
Best Regards,
-stacey.
----
Stacey Son
email@hidden
_______________________________________________
Do not post admin requests to the list. They will be ignored.
Darwin-kernel mailing list (email@hidden)
Help/Unsubscribe/Update your Subscription:
This email sent to email@hidden
| References: | |
| | >audit warning? (From: Godfrey van der Linden <email@hidden>) |