Audit not working on Solaris 10

hi,
I enabled bsm modules (/etc/security/bsmconv) and rebooted Solaris 10. But service is going into maintenance state. I rebooted server and I see one error saying "sys/c2audit:audit_kssl() not defined properly". I am not sure, what it is indicating and how it should be fixed. Please suggest, how can I enable it.

# cat /etc/security/audit_control
#
# Copyright (c) 1988 by Sun Microsystems, Inc.
#
# ident "@(#)audit_control.txt  1.4     00/07/17 SMI"
#
dir:/var/audit/audit-sol
flags:lo,ad
minfree:20
naflags:lo
# audit -v /etc/security/audit_control
syntax ok
# 
# svcs -a | grep audit
maintenance    13:18:04 svc:/system/auditd:default
# tail -5 /var/svc/log/system-auditd:default.log
[ Jul  5 13:18:04 Stopping for maintenance due to administrative_request. ]
[ Jul  5 13:18:04 Stopping for maintenance due to administrative_request. ]
[ Jul  5 13:18:04 Stopping for maintenance due to administrative_request. ]
[ Jul  5 13:18:04 Stopping for maintenance due to administrative_request. ]
[ Jul  5 13:18:04 Stopping for maintenance due to administrative_request. ]
#

Thanks

There are two possible ways to enable BSM auditing on Solaris. Which one did you use? Do you need to enable the my-ldm.driver?

See this reference:
https://docs.oracle.com/cd/E19227-01/820-7253/enablingusingbsmauditing/index.html

I issued "/etc/security/bsmconv" and rebooted server, but not touched my-ldm.driver

So as per the reference material did you

before you did that????

It was not added earlier. Then I added vs flag, as you see in below output and rebooted server. Still it complains about

# cat /etc/security/audit_control
#
# Copyright (c) 1988 by Sun Microsystems, Inc.
#
# ident "@(#)audit_control.txt  1.4     00/07/17 SMI"
#
dir:/var/audit/audit-sol
flags:lo,ad,vs
minfree:20
naflags:lo
# svcs -a | grep svc:/system/auditd:default
maintenance    15:10:43 svc:/system/auditd:default
#

================
Update : I am able to fix it. That was patch issue. I patched this server couple of days back and kernel patch was mismatching in both command

#uname -a 
# strings /platform/`uname -m`/kernel/sparcv9/unix | grep Generic 

I had to fix boot-archive , as mentioned in this doc and this is fixed - The "uname -a" and "showrev -p" Commands Show Different Kernel Patch Revisions

1 Like