Hi,

I run RHEL AS for a sever in my office. I shut off audit using the following commands

/etc/init.d/audit stop
chkconfig --level 12345 audit off


Now, I am getting the following things in my daily log:

Mar 31 00:00:00 winnie CROND[12064]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device
Mar 31 00:01:00 winnie CROND[12070]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device
Mar 31 00:10:00 winnie CROND[12074]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device
Mar 31 00:20:01 winnie CROND[12078]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device
Mar 31 00:30:00 winnie CROND[12


it seems like something is trying to occur every 10 minutes which I can't figure out?

I tried restarting crond and even rebooting the server since I have made the changes, but nothing helps.

Please help!

"it seems like something is trying to occur every 10 minutes which I can't figure out?"

List crontab and see if some cron job is scheduled every 10 minutes.

less /etc/crontab

----------------------------
Steve Stites

There's nothing in crontab or cron.daily or cron.hourly which points to the above. However when I looked in /var/log/cron I saw this:

Apr 1 09:10:00 winnie CROND[14470]: (root) CMD (/usr/lib/sa/sa1 1 1) Apr 1 09:10:00 winnie CROND[14470]: LAuS error - do_command.c:226 - laus_attach: (19) laus_attach: No such device

so something is trying to launch /usr/lib/sa/sa1. But I don't know how to determine what is trying to launch it because it's not in any of the above cron files...

"so something is trying to launch /usr/lib/sa/sa1. But I don't know how to determine what is trying to launch it because it's not in any of the above cron files..."

Is /usr/lib/sa/sa1 a binary or a script? If it is a script then you might be able to figure out what it is by reading it.

If /usr/lib/sa/sa1 was installed by a rpm package you can find out what rpm package installed it with:
rpm -q --whatprovides /usr/lib/sa/sa1

----------------------------
Steve Stites

I finally found the solution to the problem.


1) rpm -q --whatprovides /usr/lib/sa/sa1

this showed me that the sysstat package was requesting this (see my LAuS errors above).

2) in /etc/cron.d I have a script "sysst" :

[root@winnie cron.d]# cat sysstat
# run system activity accounting tool every 10 minutes
*/10 * * * * root /usr/lib/sa/sa1 1 1
# generate a daily summary of process accounting at 23:53
53 23 * * * root /usr/lib/sa/sa2 -A

I just commented out the second line - all set.