-
Título
An unknown error prevented insertion of event UID. User is not allowed to run sudo. Event log storage library returned an error: database disk image is malformed. -
Descripción
Users are seeing an error that they are not allowed to run sudo error on client servers.
The following errors are seen in the pmlogsrvd.log.
33601 E: An unknown error prevented insertion of event UID[data] to log /var/opt/quest/qpm4u/pmevents.db. 33601 E: Unable to update event with finish in event log at /var/opt/quest/qpm4u/pmevents.db. Storage error: Event log storage library returned an error: database disk image is malformed. Event log storage library returned an error: database disk image is malformed.
-
Causa
This could mean that the event log database is corrupt. To check run /opt/quest/sbin/pmlogadm info /var/opt/quest/qpm4u/pmevents.db -
Resolución
You will need to do the following to get the policy server back up and working:
1) stop the pmlogsrvd
2) move the corrupt database files aside
mkdir /var/opt/quest/qpm4u/olddb
mv /var/opt/quest/qpm4u/pmevents.db* /var/opt/quest/qpm4u/olddb
3) restart the pmlogsrvd
Please also check that there are no full filesystems or filesystems that have run out of inodes.Stopping the pmlogsrvd does not mean that sudo requests will fail. Pmserviced is the service responsible for servicing sudo requests (pmmasterd port) from the plugin hosts, and even if pmserviced is stopped/disabled, the plugins can use the local pmserviced/pmmasterd to perform offline evaluations. Pmlogsrvd is merely responsible for processing the eventlog files that the pmmasterd processes create and moving the event data into the eventlog database.If we need to create a new evcache directory, we will need to temporarily stop the pmserviced on the policy server, which will probably cause a slight delay on the plugin hosts for the initial sudo request when the policy server is down. Subsequent sudo requests will then be processed offline by the local pmserviced/pmmasterd until the plugin hosts notice that the services on the policy service have been restored.