Search Text         
Search Tips?
Search By   And   Or   Boolean   Exact Match   TA #
Search In   Whole Doc   Keywords Sort By  
Product   Sub Product  

View Technical Articles (sorted by Product) New/Updated in the last:    7 days      14 days      30 days             
TA # Date Created Date Updated Resolved Issue?   Printer Friendly Version of This TA   Print Article
  E-mail This TA   E-mail Article
109461 07/01/1998 09:00 AM 11/15/1999 03:51 PM
Yes No
There are many dlvr_audit(ADM) processes on the system, and they appear to slowly increase in number over time.
Keywords
message queue 50 unknown id openserver 500 502 504 v5 msgget msgctl msgop dlvr_audit audit_dmninfo passwd lp auditing ps slow poor performance increase number quantity increasing cron auditd process table development system dev sys ds osr5 5.0.0 5.0.2 5.0.4
Release
SCO OpenServer Development System Release 5.0.0, 5.0.2, 5.0.4
SCO OpenServer Enterprise System Release 5.0.0, 5.0.2, 5.0.4
SCO OpenServer Host System Release 5.0.0, 5.0.2, 5.0.4
SCO OpenServer Desktop System Release 5.0.0, 5.0.2, 5.0.4

Problem
          There are many dlvr_audit(ADM) processes on the system reported by
          ps(C). The number of these seem to slowly increase over time,
          adversely affecting system performance.

CAUSE:
          There are two possible causes of this problem:

              1. Auditing has been enabled on the system, but the audit daemon,
                 auditd(ADM), has died unexpectedly.

              2. Auditing is not enabled, but an application that uses message
                 queues has been run and/or is running on the system. This has
                 created a queue with the same message id as specified in the
                 audit sub-system configuration file:

                      /tcb/files/audit/audit_dmninfo

          In both cases, earlier invocations of dlvr_audit(ADM) (which is run
          by many system utilities including passwd(C), lp(C) and cron(C)) put
          messages in the message queue with the id specified in
          /tcb/files/audit/audit_dmninfo.

          This queue is now full, and any further invocation of dlvr_audit(ADM)
          will block waiting for the queue to drain. The queue never drains,
          causing the slowly increasing number of dlvr_audit(ADM) processes on
          the system.


Solution
          Additional dlvr_audit(ADM) processes can be prevented from
          accumulating in the system by removing:

                  /tcb/files/audit/audit_dmninfo

          kill(C) can then be used to remove the unwanted dlvr_audit(ADM)
          processes, or the system can be rebooted to clear the process table.

          In the case described under number 1 above, rebooting the system
          should re-start the audit daemon. If auditd(ADM) continues to die
          unexpectedly, contact your SCO support supplier for further
          assistance.

SEE ALSO:
          Technical Article 100819, "Unexpected messages on message queue 50 when passwd(C)
          or lp(C) are run."

          The manual pages for dlvr_audit(ADM), auditd(ADM), ps(C) and kill(C).

Back to Search ResultsBack to Search Results