Problem onshowaudit Answered: green (solid confidence) — The asker self-resolves after troubleshooting: onshowaudit needed the -n <servernum> option because a second Informix instance's audit trail was involved, and confirms it now works.

Advisory only.

Posted in 2011

Summary

A user on Solaris 10 with IDS 11.50.FC3 got "Cannot open file" from onshowaudit, even when pointing at a specific audit file (onshowaudit -f audit_tcp.1), despite correct ADTPATH, running as informix, and readable files with proper ownership/permissions. Karl Oliver suggested checking onaudit -c output, creating a new audit file with onaudit -n, and moving the files to /tmp, but none of that identified the cause. The poster found the answer himself: with two instances on the box, he had to specify the server number, e.g. onshowaudit -n 2 -u tesoreria01 -l, after which the audit data displayed correctly.

Auto-generated by DrWatson from the posts below — may be imperfect; read the full thread.

Topics: Security, Permissions & Auditing, Platform-Specific Issues

SERVIO VELASCO — Wed, 02 Feb 2011 16:49:08 — source: IIUG Forums & Mailing Lists

Hello Everybody I tried to use onshowaudit but show me "Cannot open file" I used that command with informix. My enviroment is: Sun Solaris 10 Informix Dynamic Server 11.50 FC3 My adtcfg is: more adtcfg.2 ADTMODE 1 # Auditing mode ADTPATH /opt/informix/tmp # Directory where audit trails will be written by OnLine ADTSIZE 50000 # Maximum size of any single audit trail file ADTERR 0 # Error handling modes. The directory has 770 how to permision. ls -l drwxrwx--- 8 informix informix 1024 Feb 2 10:25 tmp And the audit files trial -rw-rw---- 1 informix informix 0 Feb 2 10:25 audit_tcp.0 -rw-rw---- 1 informix informix 5252 Feb 2 10:26 audit_tcp.1 Anyone know how to resolve that problem? Thanks a lot Servio Velasco

↪ replying to SERVIO VELASCO

KARL OLIVER — Wed, 02 Feb 2011 20:07:54 — source: IIUG Forums & Mailing Lists

are you running onshowaudit or onshowaudit -f <filename> I have the following permissions set for audit dir drwxr-x--- audit_files so what you have should be ok. What does onaudit -c show when you run it ? I see you have listed config file rather than run onaudit -c Can you list the auit file with more

↪ replying to KARL OLIVER

SERVIO VELASCO — Wed, 02 Feb 2011 20:28:06 — source: IIUG Forums & Mailing Lists

↪ replying to SERVIO VELASCO

KARL OLIVER — Wed, 02 Feb 2011 20:34:36 — source: IIUG Forums & Mailing Lists

I note Audit file = 2 is there a auditfile audit_tcp.2 ? what happens when you run onshowaudit -f audit_tcp.1 ?

↪ replying to KARL OLIVER

SERVIO VELASCO — Wed, 02 Feb 2011 21:04:30 — source: IIUG Forums & Mailing Lists

↪ replying to SERVIO VELASCO

KARL OLIVER — Wed, 02 Feb 2011 21:31:43 — source: IIUG Forums & Mailing Lists

I have just about run out of ideas You could try running onaudit -n to create new audit file and see what number it creates. Maybe change location of audit file to /tmp and see if you can read them when they are created. The other thing that might be a problem is you can set up a user that can only read the audit files . Seems like you have not done that though. I assume you are running onshowaudit under informix. The only time I have had problems with onshowaudit is when the configuration file was wrong for audit file location

↪ replying to KARL OLIVER

SERVIO VELASCO — Thu, 03 Feb 2011 13:08:46 — source: IIUG Forums & Mailing Lists

Hello Karl I resolved the problem. I have two instance of database and I wished the information about the second instance. I used the following option "-n <servernum>". onshowaudit -n 2 -u tesoreria01 -l > audit_logs.unl And I can look audit data. Thanks a lot Regards Servio Velasco

Problem onshowaudit ✓ Answered: green (solid confidence) — The asker self-resolves after troubleshooting: onshowaudit needed the -n <servernum> option because a second Informix instance's audit trail was involved, and confirms it now works.Advisory only.

Problem onshowaudit Answered: green (solid confidence) — The asker self-resolves after troubleshooting: onshowaudit needed the -n <servernum> option because a second Informix instance's audit trail was involved, and confirms it now works.

Advisory only.