Kernel Warning: audit space low

Question

Level 1

0 points

Kernel Warning: audit space low

Hi, got a little log error I've been noticing every now and then lately.

The thing is that there has been some log entries by the kernel concerning that "audit" log space is low (System HDD/Partition is not full if that would have to do with it). I usually don't bother about logging errors/warnings, but since the kernel outputted it and because I haven't figured out completely what audit does I decided to see if anyone here knows what's up. This is what I get in the console:
2009-11-18 19.33.08 kernel Warning: audit space low (< 5% free)on audit log file-system

Is this anything I should worry about or is this just something I can ignore?

Thanks.

20" Intel Core 2 Duo 2.66 GHz early 2008, Mac OS X (10.6.2), 4 GB RAM, ATI Radeon HD 2600 Pro 256 MB VRAM

Posted on Nov 18, 2009 10:48 AM

Reply

Answer 1

K T

Level 7

23,889 points

Nov 18, 2009 10:58 AM in response to Chessax

The OS needs free space to work properly as part of what you may think is generally available. When this gets down below what the system normally requires, these types of alerts will normally appear.

Not knowing your drive size and free space, I can't speculate how much margin, if any, you have available for both your needs and those of the OS.

Best advice it to either clear out all the cruft and/or go shopping for a larger HD - good news is, the prices are low now.

Reply

Answer 2

Kappy

Level 10

362,007 points

Nov 18, 2009 11:59 AM in response to Chessax

This is not a problem generally associated with free space on the hard drive. However, it's a low-level system error connected to some log operation. It may be that an existing log file is too large or has become corrupted such that the OS cannot add to the log. It's also possible the error is caused by software you hare running.

Have you tried just rebooting? See if this stops the problem. If it does not, then try creating a new user account and logging into that account. See if the console log entries cease.

Download utility software such as TinkerTool System and use it to clear and delete old log files and force running the Unix maintenance scripts. What utility software you use be sure it's Snow compatible as older versions could cause problems.

Reply

Answer 3

Chessax Author

Level 1

0 points

Nov 18, 2009 12:17 PM in response to Chessax

My free space is above 13.5 GB atm (with computer been running all day) (whole partition is 285 GB), a little low maybe but I haven't been bothered to fix it yet, guess I'll have to do some data moving sometime to see if it helps, though I hardly see how over 13 GB isn't enough.

And restarting does work for a while, but a few days later I got the same error once again, so it's persistent, I got TinkerTool so I'll try to see what it can do too.

I also forgot to post an error I got too, usually repeated 3 times before the low space warning:
com.apple.auditd\[2365\] /etc/security/audit_warn: line 5: logger: command not found
Checked the audit_warn executable and doesn't seem like it's broken, but I'm no shelljunkie:
#!/bin/sh
#
# $P4: //depot/projects/trustedbsd/openbsm/etc/audit_warn#3 $
#
logger -p security.warning "audit warning: $@"

I'll see if anything works and reply later what happens.

Reply

Answer 4

baltwo

Level 9

62,386 points

Nov 18, 2009 1:28 PM in response to Chessax

Apparently, you've enabled the audit system IAW http://manuals.info.apple.com/enUS/Leopard_Security_Config_2ndEd.pdf which describe Security Auditing (pg. 221) and Common Criteria tools. A restart will close the current audit log and start a new one. Apparently, the current one's grown too large.

Reply

Answer 5

Chessax Author

Level 1

0 points

Nov 19, 2009 3:16 AM in response to baltwo

I'm not sure I have Installed that package, but I guess I must have done it... What is it for anyway? Is this one of those things that "If you don't know what it is, then you don't need it"?

The security manual you posted also says that "minfree" disk space is required otherwise audit will cause a warning, but I have no idea what "minfree" is... Also the audit logs, which I eventually managed to look up where they were kept, are overall less than 10K one was 480 K though but that was a while ago... So it can't really be that the log file is too large, maybe it's just cause I only got 13 GB of 285 GB left, still don't know what "minfree" means.

What if I wish to turn it off then? According to the manual, turning it on would be to add a line to "/etc/hostconfig", so removing it should stop audit from running... But the problem is there is no "AUDIT=-YES-" entry in that file, and as I've noticed earlier the hostconfig file also says: "# This file is going away", has that already happened, and simply kept for backwards compatibility or will it do so in the future? So how would I turn it off then?

Thanks.

Reply

Answer 6

baltwo

Level 9

62,386 points

Nov 19, 2009 12:00 PM in response to Chessax

Do a google search for minfree and you'll know as much as I would if I did it. AFAIK, you need to use the CLI command *audit -t* to turn it off. It might require admin rights, so the command might be *sudo audit -t*. The manpage for the command has the minimal details. That's about all I know.

Reply