
Chapter 2 Setting Up XSCF 2-119
If the audit trail becomes full while count is the specified policy, new audit trail data is
discarded, and the number of times that records are dropped is counted.
If you plan to specify suspend, you need to generate in advance a user account that has the
auditadm privilege specified, and whose audit policy is set to disable.
If an audit trail becomes full when suspend is specified, XSCF will be locked. When this
happens, login using the user account that you set up in advance with audit policy set to
disable, and clear the audit trail space. Then continue with XSCF operation.
If the audit trail space becomes full when "suspend" is specified, and you haven't previously
set up in advance a user account with audit policy "disable", you will not be able to clear the
audit trail space or perform any other functions. In this case, you must log in as default user
from the console, as described in "Setup Summary by the XSCF Shell" on page 2-2. Then
clear the audit trail space as default user.
Note – (4) Warnings are displayed as console messages and secure email. The following is
an example.
WARNING: audit trail is 91% full
You can clear space by manually transferring the current audit trail files to remote storage or
by deleting them. For details of transferring or deleting, see “Enabling or Disabling Audit,
Transferring a Log File, and Deleting Audit Data”, the viewaudit(8) man page, or the
XSCF Reference Manual. For audit policy details, see the Administration Guide.
Note – (5) For detail of viewaudit(8) command, see the XSCF Reference Manual.
Kommentare zu diesen Handbüchern