IBM AIX 7.3 – Common Problem 023 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

/audit filesystem fills up and audit subsystem stops logging.

Environment & Reproduction

IBM AIX 7.3 LPAR exhibiting AIX audit subsystem flooding issues under standard PowerVM workloads.

lsattr -El sys0 | grep audit
ls -lh /audit

Root Cause Analysis

audit events generate large bin files faster than the rotation script can compress.

Quick Triage

Confirm scope with errpt, recent changes, and subsystem state via lssrc.

audit query
ls -l /audit

Step-by-Step Diagnosis

Review /etc/security/audit/config and bin sizes.

audit query
cat /etc/security/audit/config

Solution – Primary Fix

Rotate audit bins, compress old data, and trim event classes.

audit shutdown
audit start

Solution – Alternative Approaches

Forward audit to syslog/SIEM via streamcmds to avoid local bin growth.

Verification & Acceptance Criteria

Confirm subsystem returns to RUNNING state and errpt shows no new entries.

audit query
df -g /audit

Rollback Plan

Restore prior configuration from mksysb or alt_disk_install clone if the fix regresses.

audit shutdown

Prevention & Hardening

Encode the fix in NIM customisation scripts and monitor via topas/nmon.

smit audit  # adjust binsize and freespace

Related Errors & Cross-Refs

errpt LABEL=AUDIT_*; bin overflow

Related tutorial: View the step-by-step tutorial for aix-7.3.

View all aix-7.3 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

AIX auditing subsystem reference