3/6/13 Document Display

https://support.oracle.com/epmos/faces/ui/km/SearchDocDisplay.jspx?_adf.ctrl-state=7knk5xhhj_118 1/1

/etc/security/audit_warn: Hard limit exceeded in all file systems [ID 1017624.1]

Modified: Aug 1, 2012 Type: PROBLEM Migrated ID: 228801 Status: PUBLISHED Priority: 3

Applies to:

Solaris SPARC Operating System - Version 8.0 and laterAll Platforms

Symptoms

This message appears in the console:

/etc/security/audit_warn: Hard limit exceeded in all file systems

There's no access to the system either via console or telnet, although system/domain responds to ping.

Telnet responds as well, but it freezes after showing the "login:" line.

Cause

What this message means is that the audit tool cannot write any more records, as the defined space available to doso is full.

Solution

If the system is already hung:

1. Take the system/domain to the OK prompt.2. Start the system in single user mode.3. Free up some space in the file system where the audit records are saved (/var/audit by default)4. Start the system normally

To check what is the actual path where audit records are saved, take a look at the dir: line in the/etc/security/audit_control file.

If by any means the system is still accessible, follow only step 3.

Another approach would be to reduce the minfree: value in the audit_control file.

For more information review: the audit, audit_control and audit_warn man pages.

ProductSolaris 8 Operating SystemSolaris 9 Operating SystemSolaris 10 Operating System