IBM AIX 7.3 – Common Problem 94 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

AIX audit subsystem stops collecting events without alarm.

Environment & Reproduction

Triggered by full /audit filesystem or bad /etc/security/audit/config.

Root Cause Analysis

auditbin buffers stall when streamcmds cannot flush to disk.

Quick Triage

Run audit query and lssrc -s audit to confirm state.

Step-by-Step Diagnosis

Check df -k /audit and /etc/security/audit/streamcmds output.

Solution – Primary Fix

Restart with audit shutdown then audit start once /audit has space.

Solution – Alternative Approaches

Alternative: switch to bin mode in /etc/security/audit/config temporarily.

Verification & Acceptance Criteria

Verify with audit query and tail -f /audit/stream.out that events flow.

Rollback Plan

Archive old bins to tape then truncate /audit/* safely.

Prevention & Hardening

Add a cron job to compress and rotate /audit content nightly.

Related Errors & Cross-Refs

Related: AUDIT_BIN_FULL entries and missed login records.

Related tutorial: View the step-by-step tutorial for aix-7.3.

View all aix-7.3 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM Docs: AIX auditing subsystem configuration.