AUDIT PROCESS EXCEPTION: major 12, minor 4, severity 17, state 1
T.K.Ramanathan
I had the following error on our system (AIX 4.2.1, Sybase 11.0.3.3 &
Repserver 11.0.3) on a Sunday night when there is almost ZERO activity.
Our Application was also shutdown for a routine weekend "tar" backup
when this error happened.
01:1999/03/22 03:34:35.34 server AUDIT PROCESS EXCEPTION: major 12,
minor 4, severity 17, state 1
01:1999/03/22 03:34:35.34 server ***** audproc: THE AUDIT PROCESS IS
TERMINATING. *****
01:1999/03/22 03:34:35.34 server ***** audproc: WARNING: AUDITING IS
NOT ENABLED. *****
01:1999/03/22 03:34:36.34 server Error: 7618, Severity: 20, State: 1
01:1999/03/22 03:34:36.35 server The audit process is not currently
active. Contact a user with System Administrator (SA) or System Security
Officer (SSO) role.
01:1999/03/22 03:34:36.35 kernel ************************************
01:1999/03/22 03:34:36.36 kernel pc: 0x1001e080 pcstkwalk+0x3c()
01:1999/03/22 03:34:36.36 kernel pc: 0x1001e6e8 ucstkgentrace+0x18c()
01:1999/03/22 03:34:36.36 kernel pc: 0x1001d280 ucbacktrace+0x94()
01:1999/03/22 03:34:36.36 kernel pc: 0x1000a454
terminate_process+0x7c()
01:1999/03/22 03:34:36.36 kernel pc: 0x10016dc8 close_network+0x18()
01:1999/03/22 03:34:36.36 kernel pc: 0x10016cb8 hdl_default+0x40()
01:1999/03/22 03:34:36.36 kernel pc: 0x100170f8 ex_raise+0x28c()
01:1999/03/22 03:34:36.36 kernel pc: 0x1013eb10 send_audit+0x19c()
01:1999/03/22 03:34:36.36 kernel pc: 0x1000a55c
terminate_process+0x184()
01:1999/03/22 03:34:36.36 kernel pc: 0x10021a84 quitfn+0x12c()
01:1999/03/22 03:34:36.36 kernel [Handler pc: 0x10016d64 hdl_backout
installed by the following function:-]
01:1999/03/22 03:34:36.36 kernel pc: 0x10137a88 login+0xbc()
01:1999/03/22 03:34:36.36 kernel [Handler pc: 0x10016d64 hdl_backout
installed by the following function:-]
01:1999/03/22 03:34:36.36 kernel [Handler pc: 0x100ccb6c ut_handle
installed by the following function:-]
01:1999/03/22 03:34:36.36 kernel pc: 0x10020a64 conn_hdlr+0x1920()
01:1999/03/22 03:34:36.37 kernel pc: 0x1012becc kpcoldstart+0x1c()
01:1999/03/22 03:34:36.37 kernel end of stack trace, spid 7, kpid
7864440, suid 0
What does the message "AUDIT PROCESS EXCEPTION: major 12, minor 4,
severity 17, state 1" actually mean?
After this error, our Application did not start as it could not connect
to Sybase. Even the Replication server could not connect to the RSSD DB
sitting on the SQL Server.
Our problem was resolved after we restarted all sybase servers. My worry
is....this problem has happened 3 times. For now we have disabled
auditing to prevent further occurence of the problem. SQL Server
parameter "audit queue size" was set to 100.
Any thoughts/inputs are most welcome.
TIA,
Ram
Standard Chartered Bank
Singapore
Karl Jost
in ASE Troubleshooting Guide .
Karl Jost
RTL Television
Anthony Mandic
>
> major12, minor 4 means error 1204 (out of locks). See also the error writeup
> in ASE Troubleshooting Guide .
Hmmm ... this problem was posted just a few days ago. Looks like
it might be a bug with the type of auditing going on. Perhaps its
chewing up locks and not freeing them. Certainly, running out of
locks would prevent other connections from being made. However,
I would expect to see an error message in the log reporting this
fact. Perhaps its time for Sybase to consider some sort of lock
resource management along the lines of thresholds to prevent any
one single process taking all the locks.
-am
Karl Jost
issue. The response from sybase was to increase the 'number of locks'. During that
period I did a lot of autiting and my impression was in fact the the audit process
itself may cause this problem. But it's very hard to find out. I turned auditing
of errors on, but if the audit process gets in trouble these events never will be
audited.....
I had to reboot the server turned off many auditing events. Since then there were
no problems. So my conclusion is that auditing itself causes the problems.
Karl Jost