RE: [ISSForum] BSM Audit Daemon

[MY-Nicholas Ng]

I believe you have enabled the BSM auditing in your Solaris 8. �By default, the log file in /var/audit will grow continuously. Server Sensor actually utilizes this log file to monitor the OS Events. This problem does NOT "belong" to Solaris nor Server Sensor, ....just misconfigured.   There are 2 ways to resolve this issue:-   1)       Download and install �the clear.sh script from ISS to automatically clear the audit log OR 2)       Configure the Server Sensor to clear the audit log. (This is a lot easier!). You can configure this by right click on the Server Sensor in the managed asset window. Go to properties. In one of the tab (sorry I can't remember the name :P) where allow you to choose the options of �clearing the audit log in a drop-down list. Basically, there are 3 options for you to choose from on how the Sensor Sensor can manage the audit log.     Hope this helps.     Nicholas EK Ng Associate Consultant e-Cop.net Surveillance tel: (603) 8996 3000 ext.213 fax:(603) 8996 3001 [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Friday, October 10, 2003 8:27 PM To: [EMAIL PROTECTED] Subject: [ISSForum] BSM Audit Daemon   Guys, We have a Server Sensor in Solaris 8 and that has some troubles concerning BSM. Like follow: 1. Is generanting an event named "Sensor Error" displaying (SS_ourmachine) - issBsmLogReader:GetData() cannot read default audit file.; 2. The directory /var/audit is always full of data, causing 100% File System. Anyone could explain what is happening? Does this trouble belong to the Sun Solaris System or the Server Sensor application? How to solve it, please? Cristian Castilhos