IBM AIX 7.3 – Common Problem 122 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

/audit fills and AIX auditing stops logging events.

Environment & Reproduction

Audit bin/stream files outgrow /audit FS over time.

Root Cause Analysis

audit subsystem cannot rotate when destination FS is full.

Quick Triage

Run df /audit and lssrc -s auditd / audit query.

Step-by-Step Diagnosis

Inspect /etc/security/audit/config for bin/stream sizes.

Solution – Primary Fix

Rotate with audit shutdown then auditstream + audit start with new bin paths.

Solution – Alternative Approaches

Move /audit to its own JFS2 with adequate size and quota.

Verification & Acceptance Criteria

audit query shows active subsystem and FS usage under 80%.

Rollback Plan

Disable audit temporarily with audit off if blocking ops.

Prevention & Hardening

Ship audit logs offline to SIEM with cron and gzip.

Related Errors & Cross-Refs

Pairs with bos.rte.security fileset alerts.

Related tutorial: View the step-by-step tutorial for aix-7.3.

View all aix-7.3 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM Docs: AIX auditing.