help with audit_warn

UNIX Solaris
1

hi everyone i have this error in the console but i dont have any idea about wath is the problem anyone can help me please

the msj is

/etc/security/audit_warn: Hard limit exceeded on all filesystems

2

You have a quotes settings on your filesystems.
Use command quota for research this question.
Quotes may be soft and hard, and your message tell you what hard quote is limit exceeded on all filesystems

3

You are probably getting large numbers of alerts sent to /var/adm/messages

A stop/start of the auditd process may well be required:

Solaris 9
# /etc/rc2.d/S99audit stop

Solaris 10
# svcadm disable svc:/system/auditd:default

Check it's down / then restart it:

 Solaris 9
# /etc/rc2.d/S99audit start

Solaris 10
# svcadm enable svc:/system/auditd:default

Make sure you're not getting the messages anymore.

% tail -f /var/adm/messages

Check free space on root file system.

% df -k /

clear down your messages files if required e.g.

cat /dev/null > /var/adm/messages

HTH,

4

thanks i go and check ufs / , i have other cuestion , can i change the hard limit value to increase and avoid the messages .

thanks a lot