When Auditds or nauditds is loaded, large amounts of memory are consumed

  • 3632992
  • 14-Jul-2006
  • 26-Apr-2012

Environment

Novell Audit 2.0.0
Novell Audit 2.0.1
Novell Audit 2.0.2

Situation

When starting ndsd on Linux or Solaris, ndsd takes most, if not all the available memory in the server.
If you go into the ndsmodules.conf file and comment out auditds, and then do an ndsd stop|start, the large memory consumption will go away.
Loading AUDITDS.NLM on NetWare will cause low memory conditions to arise.
Loading nauditds.dlm on Windows will cause low memory available for other applications.

Resolution

The eDirectory log application object within the Secure Logging Server (SLS) has become corrupted. Please do the following steps to resolve the problem:
a.) Login to iManager. Typically this is done athttp:///nps/iManager.html.
b.) Click on the "Auditing and Logging" link. Click on the "Logging Server Options". Browse to your Secure Logging Server (SLS) object. Normally the SLS is located in the "Logging Services" container just off of root. Once you have your SLS, click on the "OK" button.
c.) Click on the "Log Applications" tab. Put a check mark next to the log application you wish to delete. In this case it will be eDirectory. Click on the "Application Actions" link and click on "Delete". You may be prompted to confirm you selection.
d.) Once the application has been deleted, put a check mark next to "Applications" and click on the "Application Actions" link. Select "New". Put in the name of the application (eDirectory Instrumentation). Then browse out to where your LSC file is contained. If you have a Novell Audit CD, the LSC files are in the \NetWare\base\system\naudit directory. The eDirectory instrumentation's LSC file is edir_en.lsc. Once you have selected the eDirectory LSC file, click on the OK button.
e.) Now that you have your log application installed, shutdown and restart the SLS (lengine).
NOTE: It may be necessary to stop and start the instrumentation for the memory usage to go away. On NetWare you unload and load AUDITDS.NLM. In Windows you want to stop and start nauditds.dlm. (If stopping and starting nauditds.dlm does not help, then restart eDirectory.) On Solaris and Linux, cd to /etc/init.d/ and do an ./ndsd stop and ./ndsd start . Make sure that you are logged in as root when stopping and starting ndsd.

Additional Information

If you notice other modules/instrumentations taking large amount of memory, such as AUDITNW.NLM, then do the above steps for the NetWare instrumentation. The LSC file for NetWare is nw_en.lsc.