Customer’s painpoint and requirement:
Before finishing the steps of PIM starting, the sane test of audit file should be conducted at the first time.
For instance, “seload” simply don’t start PIM and check the seaudit file first. Then if there is no problem on seaudit file, “seload” should be executed as the next step.
If seos.audit file is corrupted, then seos.audit recovery should be conducted automatically.
- System hang (abnormal stopping and no response from system) occurs.
- System reboot forcedly. (seos.audit file also might be corrupted at this point)
- PIM start (seload)
PIM don’t appear any abnormal message on syslog, showing especially seos.audit file has been corrupted.
So customer could think PIM has no problem at this point.
- Run seaudit command
- Suddenly lots of seaudit error message are written to syslog.
Because of this error message, customer should stop PIM intentionally and found some loss on audit log that could be written after starting PIM.
Sometimes customer couldn’t notice seos.audit corruption for a while. This means some audit record could be lost and it makes the customer’s belief to shake.
Many customer thinks the audit records as evidence to be reported to high-up and government.