PAMSC(EP) r14.1 CP02: can't delete seos.audit.bak file.

Products

• CA Privileged Access Manager - Server Control (PAMSC)

Issue/Introduction

seos.audit.bak* files cannot be deleted although override rule is defined.

Rules:
CA Privileged Access Manager Server Control dbmgr v14.10.0.1265 - Database to Script Dump
Copyright (c) 2018 CA. All rights reserved.
editres FILE ('/opt/CA/PAMSC/log/seos.audit') audit(ALL) defaccess(r) warning  owner('root')
editres FILE('/opt/CA/PAMSC/log/seos.audit.bak*') audit(ALL) defaccess(r) warning  owner('root')
authorize FILE ('/opt/CA/PAMSC/log/seos.audit') access(ALL) uid('root')
authorize FILE ('/opt/CA/PAMSC/log/seos.audit.bak*') access(ALL) uid('root')

Audit log:
18 Feb 2020 11:23:35 D FILE         root   5e4a937b:000078aa Erase 995 10 /opt/CA/PAMSC/log/seos.audit.bak.15-Feb-2020-00:00:01 /bin/rm              server                  

Environment

Release : 14.1 CP02

Component : PAM SERVER CONTROL ENDPOINT UNIX/LINUX

OS: Linux

Cause

The root cause is that the kernel table entries for seos.audit.* files got corrupted after renaming.

Resolution

It will fixes in PAMSC r14.1 CP03.
If you need testfix, acpatch-DE448751-14.10.0.1326-_LINUX_X64.zip, before releasing PAMSC r14.1 CP03,
please contact and open support case.

Additional Information

Following steps to delete back up file as workaround.
    - stop PAMSC before delete backup files.
    - Configure audit_max_files at logmgr in seos.ini

And this problem is only occurred PAMSC 14.1 CP02 on Linux environment.