My Oracle Support Banner

BSM: "/etc/security/audit_warn: Auditing has been turned off unexpectedly" Message in audit_warn File (Doc ID 1018838.1)

Last updated on DECEMBER 18, 2023

Applies to:

Solaris Operating System - Version 8 6/00 U1 and later
All Platforms

Symptoms

The Solaris[TM] Operating System audit daemon (/usr/sbin/auditd) may exit unexpectedly, generating the following message and mail to audit_warn:

A machine hang may accompany the message if the audit  event queue is full when the audit daemon exits. This problem happens only if the auditd is running on a multi-CPU machine.

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.