Fujitsu SPARC Enterprise M4000 User Manual page 120

Note – (3) If an audit trail becomes full while suspend is specified, XSCF Shell or
XSCF Web operation will be locked; you will not be able to complete the operation.
Writing any further entries to the audit trail stops until you either clear out some
audit trail space, or the until the audit policy is changed to count.
If the audit trail becomes full while count is the specified policy, new audit trail data
is discarded, and the number of times that records are dropped is counted.
If you plan to specify suspend, you need to generate in advance a user account that
has the auditadm privilege specified, and whose audit policy is set to disable.
If an audit trail becomes full when suspend is specified, XSCF will be locked. When
this happens, login using the user account that you set up in advance with audit
policy set to disable, and clear the audit trail space. Then continue with XSCF
operation.
If the audit trail space becomes full when "suspend" is specified, and you haven't
previously set up in advance a user account with audit policy "disable", you will not
be able to clear the audit trail space or perform any other functions. In this case, you
must log in as default user from the console, as described in "Setup Summary by the
XSCF Shell" on page 2-2. Then clear the audit trail space as default user.
Note – (4) Warnings are displayed as console messages and secure email. The
following is an example.
WARNING: audit trail is 91% full
You can clear space by manually transferring the current audit trail files to remote
storage or by deleting them. For details of transferring or deleting, see "Enabling or
Disabling Audit, Transferring a Log File, and Deleting Audit Data", the viewaudit
(8) man page, or the XSCF Reference Manual. For audit policy details, see the
Administration Guide.
Note – (5) For detail of viewaudit (8) command, see the XSCF Reference Manual.
2-64 SPARC Enterprise Mx000 Servers XSCF User's Guide • April 2008