Re: BSM Audit Troubleshooting help

From: Anupam (
Date: 02/11/02

From: "Anupam" <>
To: <>
Date: Mon, 11 Feb 2002 08:44:53 -0500

For the time being I have rectified the problem based on Darren Moffat's
suggested piece of code:
for i in `ls /proc`
    auditconfig -setpmask $i lo,ad,ex,fw,fm,fc,fd

When I ran "auditconfig -getpinfo 0" it came back with:
audit id = unknown(-2)
process preselection mask = no(0x0,0x0)
terminal id (maj,min,host) = 0,0,unknown(
audit session id = 0

After running the auditconfig -setpmask code, it returns:
audit id = unknown(-2)
process preselection mask = ex,ad,fd,fc,fm,fw(0x4000083a,0x4000083a)
terminal id (maj,min,host) = 0,0,unknown(::)
audit session id = 0

Questions (more out of curiosity now):
- Any hypothesis why the audit daemon suddenly stopped writing?
- What kind of events would cause the existing processes to loose their
preselection masks?

My observations:
- Based on the time stamps on the audit_control, audit_user files were
modified appropriately before bsmconv was enabled.
- Space is not an issue on the /var partition.


- Anupam