[rhn-users] RHEL3 box hanging at login

[Lamon, Frank III]

Look at the notify line in /var/audit/audit.conf  (the -N switch will
execute a command when the threshold is reached).
 
You could try something like this (don't leave out any tick marks or
quote marks):
notify          ="/usr/sbin/audbin -S /var/log/audit.d/save.%u -C -T 70%
-N 'mail -s "audit filling up var alert"  <mailto:user at yada.com'>
user at yada.com'";
 
If you don't really need all that audit info (it can range from months
to years of data) you can change the notify line to the following and it
will just rotate through the four 20M log files (default) using a first
in - first out process. This is usually enough audit data for most
people, but make sure of your own audit log requirements first:
notify          = "/usr/sbin/audbin -C";


-----Original Message-----
From: rhn-users-bounces at redhat.com
[mailto:rhn-users-bounces at redhat.com]On Behalf Of caranas at lexmark.com
Sent: Sunday, November 13, 2005 8:22 PM
To: Red Hat Network Users List
Cc: rhn-users at redhat.com; rhn-users-bounces at redhat.com
Subject: RE: [rhn-users] RHEL3 box hanging at login



Hi Tom, 

I'm new to Linux.  Maybe you could help me.  How will I make such that
if my /var directory is 70% full it would send me an email. 

Hoping for your favorable response. 

Thanks and more power.


Clark James E. Aranas
System Administrator
Printhead Technology
Phone Number    : 63.32.2348873
Mobile Numbers : 63.92.143.143.87
TSC Hotline                 : 63.92.871.284.28

-=Lexmark Confidential=- 



	Tom Hodder <tom at ecnow.co.uk> 
Sent by: rhn-users-bounces at redhat.com 


11/14/2005 00:09 
Please respond to Red Hat Network Users List 


        
        To:        rhn-users at redhat.com 
        cc:         
        Subject:        RE: [rhn-users] RHEL3 box hanging at login



Quoting "Lamon, Frank III" <Frank_LaMon at csx.com>:

> Check out the size of your /var directory - it's probably over 80%. 
> Depending on your update level the default setting for auditd is to 
> suspend auditable actions (logons, etc) once the filesystem reaches a 
> certain threshold (80%  is default I think).

That was true as well, 89% full in fact. I have setup a notify at 90%, 
so I had
better take that down to 70% to be safe.

Thanks,

Tom





> Quoting Thomas Holzgruber <thomas.holzgruber at byting.at>:
>
>> Hi,
>>
>> i had the same problem, i turned off the audit daemon to start at
>> boot time to solve this problem.
>>
>
> Worked like a charm, Thanks!
>
> Now to find out whats wrong with the audit daemon...
>
> Tom
>
>
>
>> //thomas
>>
>> Tom Hodder wrote:
>>
>>> Hi,
>>>
>>> In a blade farm of a hundred or so RHEL3 boxes, 2 of these machines
started
>>> hanging after the password was entered at the login prompt, both 
>>> via ssh and
>>> locally, this was after a few days of running time.
> _____________________________
>> rhn-users mailing list
>> rhn-users at redhat.com
>> https://www.redhat.com/mailman/listinfo/rhn-users
>>
>
>
>
>
>
>
>
>
> _______________________________________________
> rhn-users mailing list
> rhn-users at redhat.com
> https://www.redhat.com/mailman/listinfo/rhn-users
>
> -----------------------------------------
> This email transmission and any accompanying attachments may contain
CSX
> privileged and confidential information intended only for the use of
the
> intended addressee.  Any dissemination, distribution, copying or
action
> taken in reliance on the contents of this email by anyone other than
the
> intended recipient is strictly prohibited.  If you have received this
email
> in error please immediately delete it and  notify sender at the above
CSX
> email address.  Sender and CSX accept no liability for any damage
caused
> directly or indirectly by receipt of this email.
>
>
> _______________________________________________
> rhn-users mailing list
> rhn-users at redhat.com
> https://www.redhat.com/mailman/listinfo/rhn-users
>








_______________________________________________
rhn-users mailing list
rhn-users at redhat.com 
https://www.redhat.com/mailman/listinfo/rhn-users




-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/rhn-users/attachments/20051114/94d84fa0/attachment.htm>