<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.0 Transitional//EN"> <HTML><HEAD> <META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii"> <META content="MSHTML 6.00.2800.1523" name=GENERATOR></HEAD> <BODY> <DIV>Look at the notify line in /var/audit/audit.conf (the -N switch will execute a command when the threshold is reached).</DIV> <DIV> </DIV> <DIV>You could try something like this (don't leave out any tick marks or quote marks):</DIV> <DIV>notify ="/usr/sbin/audbin -S /var/log/audit.d/save.%u -C -T 70% -N 'mail -s "audit filling up var alert" <A href="mailto:user@yada.com'">user@yada.com'</A>";</DIV> <DIV> </DIV> <DIV>If you don't really need all that audit info (it can range from months to years of data) you can change the notify line to the following and it will just rotate through the four 20M log files (default) using a first in - first out process. This is usually enough audit data for most people, but make sure of your own audit log requirements first:</DIV> <DIV>notify = "/usr/sbin/audbin -C"; </DIV> <BLOCKQUOTE> <DIV class=OutlookMessageHeader dir=ltr align=left>-----Original Message----- From: rhn-users-bounces@redhat.com [mailto:rhn-users-bounces@redhat.com]On Behalf Of caranas@lexmark.com Sent: Sunday, November 13, 2005 8:22 PM To: Red Hat Network Users List Cc: rhn-users@redhat.com; rhn-users-bounces@redhat.com Subject: RE: [rhn-users] RHEL3 box hanging at login </DIV> Hi Tom, I'm new to Linux. Maybe you could help me. How will I make such that if my /var directory is 70% full it would send me an email. Hoping for your favorable response. Thanks and more power. Clark James E. Aranas System Administrator Printhead Technology Phone Number : 63.32.2348873 Mobile Numbers : 63.92.143.143.87 TSC Hotline : 63.92.871.284.28 -=Lexmark Confidential=- <TABLE width="100%"> <TBODY> <TR vAlign=top> <TD> <TD>Tom Hodder <tom@ecnow.co.uk> Sent by: rhn-users-bounces@redhat.com 11/14/2005 00:09 Please respond to Red Hat Network Users List <TD> To: rhn-users@redhat.com cc: Subject: RE: [rhn-users] RHEL3 box hanging at login</TR></TBODY></TABLE> Quoting "Lamon, Frank III" <Frank_LaMon@csx.com>: > Check out the size of your /var directory - it's probably over 80%. > Depending on your update level the default setting for auditd is to > suspend auditable actions (logons, etc) once the filesystem reaches a > certain threshold (80% is default I think). That was true as well, 89% full in fact. I have setup a notify at 90%, so I had better take that down to 70% to be safe. Thanks, Tom > Quoting Thomas Holzgruber <thomas.holzgruber@byting.at>: > >> Hi, >> >> i had the same problem, i turned off the audit daemon to start at >> boot time to solve this problem. >> > > Worked like a charm, Thanks! > > Now to find out whats wrong with the audit daemon... > > Tom > > > >> //thomas >> >> Tom Hodder wrote: >> >>> Hi, >>> >>> In a blade farm of a hundred or so RHEL3 boxes, 2 of these machines started >>> hanging after the password was entered at the login prompt, both >>> via ssh and >>> locally, this was after a few days of running time. > _____________________________ >> rhn-users mailing list >> rhn-users@redhat.com >> https://www.redhat.com/mailman/listinfo/rhn-users >> > > > > > > > > > _______________________________________________ > rhn-users mailing list > rhn-users@redhat.com > https://www.redhat.com/mailman/listinfo/rhn-users > > ----------------------------------------- > This email transmission and any accompanying attachments may contain CSX > privileged and confidential information intended only for the use of the > intended addressee. Any dissemination, distribution, copying or action > taken in reliance on the contents of this email by anyone other than the > intended recipient is strictly prohibited. If you have received this email > in error please immediately delete it and notify sender at the above CSX > email address. Sender and CSX accept no liability for any damage caused > directly or indirectly by receipt of this email. > > > _______________________________________________ > rhn-users mailing list > rhn-users@redhat.com > https://www.redhat.com/mailman/listinfo/rhn-users > _______________________________________________ rhn-users mailing list rhn-users@redhat.com https://www.redhat.com/mailman/listinfo/rhn-users </BLOCKQUOTE></BODY></HTML>