IBM Support

IJ33375: AUDIT CAN FAIL TO RESTART WHEN LARGE NUMBER OF OBJECTS ARE AUDITAPPLIES TO AIX 7100-05

Subscribe to this APAR

By subscribing, you receive periodic emails alerting you to the status of the APAR, along with a link to the fix after it becomes available. You can track this item individually or track all items by product.

Notify me when this APAR changes.

Notify me when an APAR for this component changes.

 

APAR status

  • Closed as program error.

Error description

  • ****************************************************************
    * USERS AFFECTED:
    * Systems running the 7100-05 Technology Level with
    * any of the following filesets at or between the given levels:
    * MIN          MAX          FILESET
    * 7.1.5.41     7.1.5.42     bos.mp64
    ****************************************************************
    * PROBLEM DESCRIPTION:
    * When audit runs with a large number of objects and
    * some of the objects might not actually exists,
    * audit shutdown then audit start can fail with :
    * # audit start
    * ** failed setting kernel audit objects
    * To verify the problem you can run :
    * # echo "xm -u" | kdb|grep ObjectCreate
    * 0000000000036900 873 9CECD0 .ObjectCreate+00004C
    * 000000000000CA20 873 9CED04 .ObjectCreate+000080
    * These lines shouldn't appear when audit is shutdown
    * as objects should be removed during the shutdown process.
    ****************************************************************
    * RECOMMENDATION:
    * Install APAR IJ33375.
    ****************************************************************
    

Local fix

Problem summary

  • ****************************************************************
    * USERS AFFECTED:
    * Systems running the 7100-05 Technology Level with
    * any of the following filesets at or between the given levels:
    * MIN          MAX          FILESET
    * 7.1.5.41     7.1.5.42     bos.mp64
    ****************************************************************
    * PROBLEM DESCRIPTION:
    * When audit runs with a large number of objects and
    * some of the objects might not actually exists,
    * audit shutdown then audit start can fail with :
    * # audit start
    * ** failed setting kernel audit objects
    * To verify the problem you can run :
    * # echo "xm -u" | kdb|grep ObjectCreate
    * 0000000000036900 873 9CECD0 .ObjectCreate+00004C
    * 000000000000CA20 873 9CED04 .ObjectCreate+000080
    * These lines shouldn't appear when audit is shutdown
    * as objects should be removed during the shutdown process.
    ****************************************************************
    * RECOMMENDATION:
    * Install APAR IJ33375.
    ****************************************************************
    

Problem conclusion

  • AIX's auditing functions were modified to prevent overlap
    between existing and nonexistent files.
    

Temporary fix

Comments

  • 7100-05 - use AIX APAR IJ33375
    7200-05 - use AIX APAR IJ33619
    

APAR Information

  • APAR number

    IJ33375

  • Reported component name

    AIX V7.1

  • Reported component ID

    5765H4000

  • Reported release

    710

  • Status

    CLOSED PER

  • PE

    YesPE

  • HIPER

    NoHIPER

  • Special Attention

    NoSpecatt / Xsystem

  • Submitted date

    2021-06-22

  • Closed date

    2021-07-06

  • Last modified date

    2022-02-11

  • APAR is sysrouted FROM one or more of the following:

    IJ32955

  • APAR is sysrouted TO one or more of the following:

Fix information

  • Fixed component name

    AIX V7.1

  • Fixed component ID

    5765H4000

Applicable component levels

  • R710 PSY U888887

       UP21/08/30 I 1000

[{"Business Unit":{"code":"BU058","label":"IBM Infrastructure w\/TPS"},"Product":{"code":"SG11R"},"Platform":[{"code":"PF025","label":"Platform Independent"}],"Version":"710","Line of Business":{"code":"LOB08","label":"Cognitive Systems"}}]

Document Information

Modified date:
19 April 2022