T-Series Servers: Solaris messages files filled with SC Alert: Audit events (Open, Close, Activate Session) (Doc ID 1531113.1)

Last updated on JULY 01, 2016

Applies to:

SPARC T3-1 - Version All Versions to All Versions [Release All Releases]
SPARC T5-2 - Version All Versions to All Versions [Release All Releases]
SPARC T5-4 - Version All Versions to All Versions [Release All Releases]
SPARC T5-8 - Version All Versions to All Versions [Release All Releases]
SPARC T3-2 - Version All Versions to All Versions [Release All Releases]
Information in this document applies to any platform.

Symptoms

The /var/adm/messages file and console contain SC Alert: Audit events, similar to the following:

SC Alert: [ID 404897 daemon.notice] Audit | minor: root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0x5D6D6C4A : challenge string = 0x7E 0x15 0x5E 0x23 0x6C 0x16 0x5C 0xAD 0x21 0x2A 0xE0 0x3 0x5E 0x87 0x3B 0x3 : success
SC Alert: [ID 709409 daemon.notice] Audit | minor: root : Set Session Privilege Level: privilege level = admin : success
SC Alert: [ID 156894 daemon.notice] Audit | minor: root : Close Session : session ID = 1860162966 : success
SC Alert: [ID 438350 daemon.notice] Audit | minor: root : Open Session : object = "/SP/session/type" : value = "shell" : success
SC Alert: [ID 665947 daemon.notice] Audit | minor: root : Close Session : object = "/SP/session/type" : value = "shell" : success
SC Alert: [ID 836814 daemon.notice] Audit | minor: root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0x60411ACD : challenge string = 0x9F 0xA 0xB1 0x8C 0xD8 0xAA 0xAF 0x5 0xF8 0x75 0xFD 0xBF 0x2 0xCB 0xEB 0x79 : success
SC Alert: [ID 665947 daemon.notice] Audit | minor: root : Close Session : object = "/SP/session/type" : value = "shell" : success
SC Alert: [ID 438350 daemon.notice] Audit | minor: root : Open Session : object = "/SP/session/type" : value = "shell" : success

 

SC Alert: Audit events can also be seen in the ILOM snapshot data in the ilom/@usr@local@bin@spshexec_show_-script_@X@logs@audit@list.out file (>= ILOM 3.2.1) or ilom/@usr@local@bin@spshexec_show_-script_@X@logs@event@list.out (< ILOM 3.2.1):

##### ilom/@usr@local@bin@spshexec_show_-script_@X@logs@audit@list.out (>= ILOM 3.2.1) / ilom/@usr@local@bin@spshexec_show_-script_@X@logs@event@list.out (< ILOM 3.2.1) #####

37307  Mon Feb  4 17:13:56 2013  Audit     Log       minor          root : Open Session : object = "/SP/session/type" : value = "shell" : success
37300  Mon Feb  4 17:08:55 2013  Audit     Log       minor          root : Open Session : object = "/SP/session/type" : value = "shell" : success
37294  Mon Feb  4 17:08:13 2013  Audit     Log       minor          root : Set Session Privilege Level: privilege level = admin : success
37293  Mon Feb  4 17:08:13 2013  Audit     Log       minor          root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0xCF6B41A9 : challenge string =0xB9 0xBD 0xBE 0x7A 0x85 0x3F 0x95 0x92 0xB9 0x3C 0xE0 0x55 0xC7 0x5B 0x47 0x4F : success
37291  Mon Feb  4 17:08:06 2013  Audit     Log       minor          root : Open Session : object = "/SP/session/type" : value = "shell" : success
37282  Mon Feb  4 17:07:09 2013  Audit     Log       minor          root : Set Session Privilege Level: privilege level = admin : success
37281  Mon Feb  4 17:07:09 2013  Audit     Log       minor          root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0x550F8492 : challenge string =0x7B 0xF1 0x88 0x30 0x56 0xA4 0x97 0xC 0xBA 0x3E 0xF5 0xBE 0x88 0xE7 0x6A 0x9E : success
37278  Mon Feb  4 17:03:12 2013  Audit     Log       minor          root : Set Session Privilege Level: privilege level = admin : success
37277  Mon Feb  4 17:03:12 2013  Audit     Log       minor          root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0x172A9FC4 : challenge string =0xF1 0xAB 0x15 0x55 0x5B 0x1B 0x80 0xF9 0xC1 0xC8 0x80 0x1B 0xD 0x7A 0xA7 0x4E : success
37275  Mon Feb  4 17:03:06 2013  Audit     Log       minor          root : Open Session : object = "/SP/session/type" : value = "shell" : success
37266  Mon Feb  4 17:02:09 2013  Audit     Log       minor          root : Set Session Privilege Level: privilege level = admin : success
37265  Mon Feb  4 17:02:09 2013  Audit     Log       minor          root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0xD5FEC1E1 : challenge string =0xFA 0x8B 0x41 0x21 0xE3 0x2D 0x55 0xFD 0xB5 0x64 0x1C 0x66 0xB6 0x16 0xA7 0xE9 : success
37262  Mon Feb  4 16:58:57 2013  Audit     Log       minor          root : Open Session : object = "/SP/session/type" : value = "shell" : success
37256  Mon Feb  4 16:58:16 2013  Audit     Log       minor          root : Set Session Privilege Level: privilege level = admin : success
37255  Mon Feb  4 16:58:16 2013  Audit     Log       minor          root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0xD51DBA87 : challenge string =0xFA 0x40 0x33 0xEE 0xA3 0x8 0xA7 0xCB 0x64 0xAF 0x5 0x2B 0x9E 0xA6 0x470x87 : success
37253  Mon Feb  4 16:58:07 2013  Audit     Log       minor          root : Open Session : object = "/SP/session/type" : value = "shell" : success
37244  Mon Feb  4 16:57:09 2013  Audit     Log       minor          root : Set Session Privilege Level: privilege level = admin : success
37243  Mon Feb  4 16:57:09 2013  Audit     Log       minor          root : Activate Session : authentication type = MD5 : privilege level = admin : initial outbound sequence number = 0x5E9A288 : challenge string = 0xA0 0x1C 0xE8 0xB4 0xFD 0x73 0x31 0xFC 0x27 0x58 0xEC 0x34 0x1A 0x87 0xF0x1E : success

 

Cause

Sign In with your My Oracle Support account

Don't have a My Oracle Support account? Click to get started

My Oracle Support provides customers with access to over a
Million Knowledge Articles and hundreds of Community platforms