IJ33619: AUDIT CAN FAIL TO RESTART WHEN LARGE NUMBER OF OBJECTS ARE AUDITAPPLIES TO AIX 7200-05

Obtain the fix for this APAR.

APAR status

• Closed as program error.

Error description

• ****************************************************************
  * USERS AFFECTED:
  * Systems running the 7200-05 Technology Level with
  * any of the following filesets at or between the given levels:
  * MIN          MAX          FILESET
  * 7.2.5.2      7.2.5.3      bos.mp64
  ****************************************************************
  * PROBLEM DESCRIPTION:
  * When audit runs with a large number of objects and
  * some of the objects might not actually exists,
  * audit shutdown then audit start can fail with :
  * # audit start
  * ** failed setting kernel audit objects
  * To verify the problem you can run :
  * # echo "xm -u" | kdb|grep ObjectCreate
  * 0000000000036900 873 9CECD0 .ObjectCreate+00004C
  * 000000000000CA20 873 9CED04 .ObjectCreate+000080
  * These lines shouldn't appear when audit is shutdown
  * as objects should be removed during the shutdown process.
  ****************************************************************
  * RECOMMENDATION:
  * Install APAR IJ33619.
  ****************************************************************
  

Local fix

Problem summary

• ****************************************************************
  * USERS AFFECTED:
  * Systems running the 7200-05 Technology Level with
  * any of the following filesets at or between the given levels:
  * MIN          MAX          FILESET
  * 7.2.5.2      7.2.5.3      bos.mp64
  ****************************************************************
  * PROBLEM DESCRIPTION:
  * When audit runs with a large number of objects and
  * some of the objects might not actually exists,
  * audit shutdown then audit start can fail with :
  * # audit start
  * ** failed setting kernel audit objects
  * To verify the problem you can run :
  * # echo "xm -u" | kdb|grep ObjectCreate
  * 0000000000036900 873 9CECD0 .ObjectCreate+00004C
  * 000000000000CA20 873 9CED04 .ObjectCreate+000080
  * These lines shouldn't appear when audit is shutdown
  * as objects should be removed during the shutdown process.
  ****************************************************************
  * RECOMMENDATION:
  * Install APAR IJ33619.
  ****************************************************************
  

Problem conclusion

• AIX's auditing functions were modified to prevent overlap
  between existing and nonexistent files.
  

Temporary fix

Comments

• 7100-05 - use AIX APAR IJ33375
  7200-05 - use AIX APAR IJ33619
  

APAR Information

• APAR is sysrouted FROM one or more of the following:

  IJ32955

• APAR is sysrouted TO one or more of the following:

Fix information

• Fixed component name

  AIX V7.2

• Fixed component ID

  5765CD200

Applicable component levels

PTF to Fileset Mapping

• U872964 bos.mp64 7.2.5.100