Did you look at your /var/adm/messages and /var/log/syslog files to see if you can locate any errors? If you are running the sendmail daemon and do require that it is used, you should correct your FQDN issue by placing a FQDN in your /etc/hosts file and restarting the sendmail daemon. Otherwise you can just kill the sendmail daemon. My guess is that the influx of syslog errors being generated by sendmail is killing the auditd daemon. Perhaps you could investigate your flags for auditing in /etc/security/audit_control and make sure that only "-ad" "lo" are about the only flags. All the rest should be in the naflags
-----Original Message----- From: Claudia Patricia Prada G [mailto:[EMAIL PROTECTED]] Sent: Tuesday, October 08, 2002 5:04 PM To: [EMAIL PROTECTED] Subject: [ISSForum] Server Sensor Solaris Dear People: I have installed a server sensor over solaris 5.7, the communication with the console is good, but it has a problem with auditd service of BSM, when i try to stop the realsecure service the server is blocked. appears the following message: #/etc/init.d/realsecure stop Stopping the ISS Daemon service..... CONDITION = auditing Oct 8 04:38:16 cobtaaadc01 sendmail[640]: My unqualified host name (cobtaaadc01 ) unknown; sleeping for retry /etc/security/original_audit_warn: Auditing has been turned off unexpectedly. Oct 8 04:39:16 cobtaaadc01 sendmail[640]: unable to qualify my own domain n ame (cobtaaadc01) -- using short name Oct 8 04:39:16 cobtaaadc01 sendmail[640]: unable to qualify my own domain name (cobtaaadc01) -- using short name Do you know what happended? Thanks for your help Claudia Prada --- Outgoing mail is certified Virus Free. Checked by AVG anti-virus system (http://www.grisoft.com). Version: 6.0.394 / Virus Database: 224 - Release Date: 03/10/2002 _______________________________________________ ISSforum mailing list [EMAIL PROTECTED] _______________________________________________ ISSforum mailing list [EMAIL PROTECTED]
