Google Groups no longer supports new Usenet posts or subscriptions. Historical content remains viewable.
Dismiss
auditd service not starting: solution
1,047 views
Skip to first unread message
Philip Brown
Mar 6, 2012, 11:50:40 AM3/6/12
to
I'm posting here, because a google search of this was useless, so I'd like to record the solution for posterity. Along with perhaps giving a hint to oracle folks to fix this :-}
After some patching and reboot, auditd was not starting up.
svc:/system/auditd:default went straight into maintenance mode.
In checking the log file, /var/svc/log/system-auditd:default.log
all that it basically said, was the incredibly (not)helpful
[ Mar 4 21:21:51 Method "start" exited with status 98 ]
It turns out that we had removed the line
set c2audit:audit_load = 1
from /etc/system
This caused the kernel-support for audit to not be loaded, so the auditd service couldnt start.
Okay, I can understand that.. but in this kind of situation,
/lib/svc/method/svc-auditd
REALLY should do more than just
exit $SMF_EXIT_MON_OFFLINE;
if auditconfig -getcond fails
The good news is, restoring that line to /etc/system and rebooting, made the service auto-start again, after clear
After some patching and reboot, auditd was not starting up.
svc:/system/auditd:default went straight into maintenance mode.
In checking the log file, /var/svc/log/system-auditd:default.log
all that it basically said, was the incredibly (not)helpful
[ Mar 4 21:21:51 Method "start" exited with status 98 ]
It turns out that we had removed the line
set c2audit:audit_load = 1
from /etc/system
This caused the kernel-support for audit to not be loaded, so the auditd service couldnt start.
Okay, I can understand that.. but in this kind of situation,
/lib/svc/method/svc-auditd
REALLY should do more than just
exit $SMF_EXIT_MON_OFFLINE;
if auditconfig -getcond fails
The good news is, restoring that line to /etc/system and rebooting, made the service auto-start again, after clear
Richard B. Gilbert
Mar 6, 2012, 3:59:50 PM3/6/12
to
unfamiliar with the concept, it goes like this.
You document:
A. what you plan to do.
B. Why you are doing it.
C. What must be done to back out the change if it causes problems.
Then you make your change. This procedure can be more elaborate if desired.
Cydrome Leader
Apr 19, 2012, 5:03:43 PM4/19/12
to
issues, and misses the point on what the OP was saying.
SMF is huge, complex, bloated and just slows down the normal way of
starting/managing/troubleshooting services.
Our SMF no longer works with the bind nameserver. It was working for years
and now no longer works. Of course, it logs nothing of value.
kill -9 and just running the process again really are easier to deal with.
David Combs
May 13, 2012, 10:51:16 PM5/13/12
to
In article <jmpujf$1oa$1...@reader1.panix.com>,
What's a "blind" nameserver? (Google seems no help)
David
David
Ian Collins
May 13, 2012, 10:53:00 PM5/13/12
to
On 05/14/12 02:51 PM, David Combs wrote:
>
> What's a "blind" nameserver? (Google seems no help)
Try typing bind correctly.
>
> What's a "blind" nameserver? (Google seems no help)
--
Ian Collins
David Combs
May 28, 2012, 9:16:53 PM5/28/12
to
0 new messages