site_archiver@lists.apple.com Delivered-To: darwin-kernel@lists.apple.com On Dec 10, 2009, at 5:27 PM, Godfrey van der Linden wrote:

Probably the wrong list, but darwin-dev seems to have died and the cocoa lists aren't really the right place either.

Saw these few lines go past in my secure.log yesterday. I don't recognise them and I'm a bit concerned. Can anybody out there explain them?

Dec 10 19:47:13 [snipped] [ loginwindow[38]: in pam_sm_authenticate(): Failed to determine Kerberos principal name. Dec 10 19:47:14 [snipped] [9430]: audit warning: allsoft

These warning messages are generated by auditd... The above indicates that the soft (disk space) limit for all filesystems has been exceeded. Your system is running low on disk space.

Dec 10 19:47:14 [snipped] [[9431]: audit warning: soft /var/audit

The above indicates that the soft limit for this directory has been exceeded.

Dec 10 19:47:14 [snipped] [[9433]: audit warning: closefile /var/audit/20091208225521.20091210084714

The above indicates that a trail file has been closed, so can now be post-processed. After the audit log gets larger than a certain size (see /etc/security/audit_control) auditd will close the trail file and open a new one. For more information see auditd(8), audit_warn(5), and audit_control(5). You may want also see the documentation on trustedbsd.org: http://www.trustedbsd.org/docs.html Best Regards, -stacey. ---- Stacey Son sson@FreeBSD.org _______________________________________________ Do not post admin requests to the list. They will be ignored. Darwin-kernel mailing list (Darwin-kernel@lists.apple.com) Help/Unsubscribe/Update your Subscription: http://lists.apple.com/mailman/options/darwin-kernel/site_archiver%40lists.a... This email sent to site_archiver@lists.apple.com