RE: [ISSForum] BSM Audit Daemon

[Tushar Ghosh]

We recently had a similar problem and support sent us a script which is self explanatory. Appended is the entire email for your reference. Trust this will be of help. Althoug we are yet to try due to the machine being heavily utilized ..   Let us know how u fare..   Rgds Tushar       -----Original Message----- From: ISS Technical Support [mailto:Support@iss.net] Sent: Wednesday, October 08, 2003 2:50 PM To: Bahaa Hudairi Cc: Basheer Ul-haq; Tushar Ghosh Subject: RE: 721435 Server Sensor 6.5 on Solaris 8.0   Bahaa,   With the release pending of Server Sensor 7.0 for Solaris, it is likely that the solution will be addressed in a 7.0 release rather than in an SR for Server Sensor 6.5. Regardless, the problem is centered around the inability of Server Sensor to clean logs quickly on busy systems. Basically, the removal or reduction of the auditing log files is being hindered by new audit events causeing the the next log to fill before the initial log is reduced. There are two work arounds that should help to allieviate this issue. First, the policy can be tweaked to reduce the number of audit events. Secondly, a cron job script can be run to clean the logs. The following Cron job script can be used to clean up BSM logs at a specified interval:   #!/bin/sh # Version 1.3 by Stephen de Vries (11/10/99) # This script runs from crontab every 10 minutes. It # deletes BSM logs if they take up more than 1MB of # space, or more than 10% of free disk space on the # logging volume.  This script should reside in % /opt/ISS/RealSecure. PATH=/usr/sbin:/usr/bin AUDITDIR=/var/audit REMOVE="/usr/bin/xargs /usr/bin/rm -f" WAIT=/usr/bin/wait MEG=1000 ALLAVAIL=`df -k ${AUDITDIR}|grep -v capacity|awk '{print $4}'` AVAIL=`expr $ALLAVAIL / 10` USED=`du -sk ${AUDITDIR}|awk '{print $1}'` if [ ${USED} -gt $MEG ] then TOOBIG=$AVAIL else TOOBIG=$MEG fi if [ "`/usr/bin/du -sk $AUDITDIR`" -gt $TOOBIG ] then HOSTNAME=`hostname` /usr/sbin/audit -n sleep 3 cd $AUDITDIR /usr/bin/ls "$AUDITDIR" |/usr/bin/egrep "[0-9]*\.[0-9]+\.$HOSTNAME"| ${REMOVE} fi   Thanks, ================================================= Joshua Backing Technical Support Engineer Internet Security Systems: <http://www.iss.net>Phone: (404) 236-2700 or (888) 447-4861 Technical Support email: [EMAIL PROTECTED] <mailto:[EMAIL PROTECTED]> PGP Public Keys <http://www.iss.net/support/howto_encrypted_email.php> Training <http://www.iss.net/education/> Internet Security Systems Product Knowledgebase <http://www.iss.net/support/knowledgebase/>     -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] Sent: Friday, October 10, 2003 3:27 PM To: [EMAIL PROTECTED] Subject: [ISSForum] BSM Audit Daemon   Guys, We have a Server Sensor in Solaris 8 and that has some troubles concerning BSM. Like follow: 1. Is generanting an event named "Sensor Error" displaying (SS_ourmachine) - issBsmLogReader:GetData() cannot read default audit file.; 2. The directory /var/audit is always full of data, causing 100% File System. Anyone could explain what is happening? Does this trouble belong to the Sun Solaris System or the Server Sensor application? How to solve it, please? Cristian Castilhos