Re: Onaudit and HP/UX

In article <5cnoif$5h6@cssun.mathcs.emory.edu>, Tracy Nedd <tracyn@asd.banctec.com> writes >Dear Fellow Informix Users: > >My configuration is a HP T500 with 2 cpus, running Informix 7.12 DSA. Nice - lucky you :-> >I have been working with Informix Tech Support to solve the following >problem: We want onaudit to write the Informix records to the O/S >audit log. In other words, I'm starting Informix's auditing with the >following command "onaudit -l 2". > >I found documentation on how to do this in the $INFORMIXDIR/release >directory in the file ONLINE_7.1, paragraph 12. I followed these >instructions and keep getting the following errors in the online.log: > >Wed Jan 15 09:09:26 1997 > >09:09:26 Auditing is Disabled for this Process > >09:09:26 OS level audit write failure (errcode = 0). >09:11:02 Checkpoint Completed: duration was 0 seconds. >09:12:24 Auditing is Disabled for this Process > >09:12:24 OS level audit write failure (errcode = 0).> >I get these errors at the rate of one per expected audit line. > This would be a return code from the system call used to write to the OS audit log. This would probably not be the normal write(2) system call but on special to HP-UX since each OS handles OS level auditing differently. Going on the normal write call (man 2 write to see the documentation for it). This should return -1 on error and set errno (look in /usr/include/sys/errno.h to lookup error codes). If the write call succeeds it should return the number of bytes written. In this call it appears to be returning 0 bytes written and no error. This possibly means a bug in Online. Make sure that oninit is has set-uid root permission on it so it can write to the OS audit log. If not consider reinstalling Online. You do not need to reinstall anything else except possibly Online Optical if you have it install (It make count as part of the engine, I'm not sure). Otherwise have you considered moving to Online DSA 7.2x ? Since HP-UX is a first-tier platform i.e. the first ports are done on this platform it should be available. >I'm hoping that somewhere out in the great big world of ours that there is >another shop that has HP's O/S level auditing turned on, and has there >Informix auditing writing to the O/S audit logs. I have tried everything >that I know of, and Informix Support hasn't come up with a thing. I know >that this is a pretty specific question, but it never hurts to ask, right? > >Thanks in advance for any help you can give a frustrated DBA! > >Tracy > >p.s. The onaudit works fine if I let Informix handle the audit logs by >running "onaudit -l 1". PPS I'd be interested to know the anser to this one. PPPS (for Tracy only) How come you want to use auditing? I would have thought the amount of info generate would defy analysis!! -- David Williams