SPARC Enterprise M3000/M4000/M5000/M8000/M9000 How to Handle XSCFU WARNING: audit trail is 99% full

Asset ID:	1-72-2121677.1
Update Date:	2017-09-06
Keywords:

Solution Type Problem Resolution Sure

Solution 2121677.1 : SPARC Enterprise M3000/M4000/M5000/M8000/M9000 How to Handle XSCFU WARNING: audit trail is 99% full

Applies to:

Sun SPARC Enterprise M3000 Server - Version All Versions to All Versions [Release All Releases]
Sun SPARC Enterprise M4000 Server - Version All Versions to All Versions [Release All Releases]
Sun SPARC Enterprise M5000 Server - Version All Versions to All Versions [Release All Releases]
Sun SPARC Enterprise M8000 Server - Version All Versions to All Versions [Release All Releases]
Sun SPARC Enterprise M9000-64 Server - Version All Versions to All Versions [Release All Releases]
Information in this document applies to any platform.
Oracle Solaris on SPARC (64-bit)

Symptoms

The following warning occur in the initial messages of the XSCFU reinitialization. These messages usually appears when a FW upgrade is performed or reset of system controller.

XSCF initial process start (pid=106)
[snip]

WARNING: audit trail is 99% full

[snip]
XSCF Initialize complete.
Mar 24 21:47:16 XXXXXXXX-sc XSCF[106]: XSCF Initialize complete.

Changes

No changes done by the customer on audit trails neither any changes on the Auditing Policy/Audit Classes

Cause

Check the current Auditing Policy, Classes, or Events

/xscf_command/@tmp@cli@bin@showaudit_all.out

Auditing: enabled
Audit space used: 4194304 (bytes)
Audit space free: 0 (bytes) =====>>> Problem No free space !!
Records dropped: 66 =====>>> 66 records are dropped due to lack of space !!
Policy on full trail: count
User global policy: enabled
Mail:
Thresholds: 80% 100%

Error message

WARNING: audit trail is 99% full

Actual audit files saved on the system reached max size of 2.0M.

hostname.example-sc_1#.100.199.100_2016-03-25T00-04-52/xscf_logs/audit
bash-3.2$ ls -lrth
total 2099
-rwxrwxrwx+ 1 oracle dba 2.0M Mar 25 05:19 @scf@log@audit@20111124141015.0000000000.localhost ==>older file
-rwxrwxrwx+ 1 oracle dba 2.0M Mar 25 05:19 @scf@log@audit@20151027150445.0000000001.orangutan-sc ==>latest file
bash-3.2$

Solution

Audit records are stored in audit files on a 4-megabyte file system on the Service Processor. You cannot change the size reserved for the audit files.

As shown above we have two partitions. Audit records are stored in one partition until it becomes full, then new records are stored in the other partition.

You can clear space by deleting them manually or transferring the files to remote storage. Until you clear space, new records are dropped.

1. Check whether Auditing is Enabled Or Disabled

XSCF> showaudit
Auditing: enabled

2. Display Current Auditing Policy, Classes, or Events

XSCF> showaudit all

3. Delete the log data of the audit trail.

XSCF>setaudit delete

4. Display the audit policy to see if you got some "Audit space free" space (3rd line in o/p) , you are good !!

XSCF>showaudit all

5. Also customer can manually move files to remote location.

Disable writing to the audit trail and transfer the log file.
XSCF>setaudit disable

**/xscf_logs/audit

6. Else if customer wish configure auditing policy for automatic transfers.

XSCF>setaudit archive

Follow procedure is mentioned in the Servers administration guide to enable log archiving & setup archive host.

Chapter -7 http://docs.oracle.com/cd/E19855-01/E21618/Logging.html#50503741_35524

Attachments

This solution has no attachment