IBM AIX 7.1 – Common Problem 121 – Diagnosis and Fix

📖 ~1 min read

Table of contents

1. Symptom & Impact
2. Environment & Reproduction
3. Root Cause Analysis
4. Quick Triage
5. Step-by-Step Diagnosis
6. Solution – Primary Fix
7. Solution – Alternative Approaches
8. Verification & Acceptance Criteria
9. Rollback Plan
10. Prevention & Hardening
11. Related Errors & Cross-Refs
12. References & Further Reading

Symptom & Impact

errpt logs AUDIT_BUFFER_FULL and audit events are lost.

Environment & Reproduction

AIX 7.2 audit subsystem enabled with default buffer sizes.

Root Cause Analysis

Audit consumer cannot drain events fast enough during peak load.

Quick Triage

Run audit query and inspect /audit/stream.out growth.

Step-by-Step Diagnosis

Capture audit start/stop status with audit status.

Solution – Primary Fix

Increase bufsize in /etc/security/audit/config and restart with audit shutdown; audit start.

Solution – Alternative Approaches

Switch to bin-mode auditing for higher throughput environments.

Verification & Acceptance Criteria

errpt no longer logs AUDIT_BUFFER_FULL during peak workload.

Rollback Plan

Restore previous bufsize and mode if performance regresses.

Prevention & Hardening

Profile audit events and prune unneeded classes per audit policy.

Related Errors & Cross-Refs

Pairs with /audit/stream.out filesystem fill events.

Related tutorial: View the step-by-step tutorial for aix-7.1.

View all aix-7.1 tutorials on the Tutorials Hub →

Browse all common problems & solutions on the Tutorials Hub.

References & Further Reading

IBM Docs: audit, /etc/security/audit/config tuning.