RE : [ISSForum] BSM Audit Daemon

[Marco Proulx]

Title: Message

I also had similar problems at my customer site.  BSM was enabled before RS deployement so scripts were developed to rotate and clean the audit directory.  I think that when cron was rotating the BSM log file, RS was loosing track of it and we were seeing similar messages.  The problem went away when we left RS do the rotating itself.  Cleaning is not really an issue.  We can still use our in-house cleaning scripts.   Good luck -----Message d'origine----- De : [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED] De la part de MY-Nicholas Ng Envoy� : 20 octobre, 2003 22:22 � : [EMAIL PROTECTED]; [EMAIL PROTECTED] Objet : RE: [ISSForum] BSM Audit Daemon I believe you have enabled the BSM auditing in your Solaris 8.  By default, the log file in /var/audit will grow continuously. Server Sensor actually utilizes this log file to monitor the OS Events. This problem does NOT "belong" to Solaris nor Server Sensor, ....just misconfigured.   There are 2 ways to resolve this issue:-   1)       Download and install  the clear.sh script from ISS to automatically clear the audit log OR 2)       Configure the Server Sensor to clear the audit log. (This is a lot easier!). You can configure this by right click on the Server Sensor in the managed asset window. Go to properties. In one of the tab (sorry I can't remember the name :P) where allow you to choose the options of  clearing the audit log in a drop-down list. Basically, there are 3 options for you to choose from on how the Sensor Sensor can manage the audit log.     Hope this helps.     Nicholas EK Ng Associate Consultant e-Cop.net Surveillance tel: (603) 8996 3000 ext.213 fax:(603) 8996 3001 [EMAIL PROTECTED] -----Original Message----- From: [EMAIL PROTECTED] [mailto:[EMAIL PROTECTED]] Sent: Friday, October 10, 2003 8:27 PM To: [EMAIL PROTECTED] Subject: [ISSForum] BSM Audit Daemon   Guys, We have a Server Sensor in Solaris 8 and that has some troubles concerning BSM. Like follow: 1. Is generanting an event named "Sensor Error" displaying (SS_ourmachine) - issBsmLogReader:GetData() cannot read default audit file.; 2. The directory /var/audit is always full of data, causing 100% File System. Anyone could explain what is happening? Does this trouble belong to the Sun Solaris System or the Server Sensor application? How to solve it, please? Cristian Castilhos