BSM: "/etc/security/audit_warn: Auditing has been turned off unexpectedly" Message in audit_warn File
Last updated on MARCH 06, 2018
Applies to:Solaris Operating System - Version 8 6/00 U1 and later
Sometimes, the Solaris[TM] Operating System audit daemon (/usr/sbin/auditd) may exit unexpectedly, generating the following message and mail to audit_warn:
"/etc/security/audit_warn: Auditing has been turned off unexpectedly."
It is possible a machine hang will accompany the message if the audit event queue is full when the audit daemon exits. This problem happens only if the auditd is running on a multi-CPU machine.
Sign In with your My Oracle Support account
Don't have a My Oracle Support account? Click to get started
My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms