The cursor file["/var/log/audit/vlog/SENTINEL/vlogoffset.conf"] is locked by another process

When you try to run the either the sentagent daemon or the VLOG command from command line you get the following error:

   Err[VLOG_CURSOR_FileValidate(535)] The cursor file["/var/log/audit/vlog/SENTINEL/vlogoffset.conf"] is locked by another process.
   Err[VLOG_CURSOR_Open(674)] VLOG_FILE_ValidatePath(cursorFilePath_ALLOC) reports: 11
   Err[VLOG_CURSOR_Open(697)] Cannot aquire lock on cursor file[/var/log/audit/vlog/SENTINEL/vlogoffset.conf].
      (A cursor file may not be shared by multiple vlog instances.)

This is most likely due to the fact that another (previous) instance of VLOG is still active.

When VLOG is executed it attempts to obtain an exclusive lock on the cursor file. If the lock cannot be obtained, another active process currently owns the lock. Identifying and killing that previous instance should resolve the issue. At s

Identify active vlog processes via:

ps -A | grep vlog

To kill all active vlog process:

killall -s SIGKILL vlog

At this point you should be able again to start VLOG.

The VLOG utility uses a cursor file to preserve the location of the last audit record processed. The cursor file contains the name of the audit stream file (including the path), as well as the current offset of the record being processed within that file.

As VLOG processes an audit record, the cursor file is updated to reflect the location of the next record to be processed. If VLOG crashes, the "cursor file" would maintain information about the last record processed, allowing a new instance of vlog to proceed from the location indicated in the cursor file.