Table of Contents
Advertisement
If the audit trail becomes full while count is the specified policy, new audit trail data
is discarded, and the number of times that records are dropped is counted.
If you plan to specify suspend, you need to generate in advance a user account that
has the auditadm privilege specified, and whose audit policy is set to disable.
If an audit trail becomes full when suspend is specified, XSCF will be locked. When
this happens, login using the user account that you set up in advance with audit
policy set to disable, and clear the audit trail space. Then continue with XSCF
operation.
If the audit trail space becomes full when "suspend" is specified, and you haven't
previously set up in advance a user account with audit policy "disable", you will not
be able to clear the audit trail space or perform any other functions. In this case, you
must log in as default user from the console, as described in "Setup Summary by the
XSCF Shell" on page 2-2. Then clear the audit trail space as default user.
Note – (4) Warnings are displayed as console messages and secure email. The
following is an example.
WARNING: audit trail is 91% full
You can clear space by manually transferring the current audit trail files to remote
storage or by deleting them. For details of transferring or deleting, see
"Enabling or
Disabling Audit, Transferring a Log File, and Deleting Audit
Data", the
viewaudit(8) man page, or the XSCF Reference Manual. For audit policy details, see
the Administration Guide.
Note – (5) For detail of viewaudit(8) command, see the XSCF Reference Manual.
Chapter 2
Setting Up XSCF 2-123
Advertisement
Table of Contents
