Removing the Update Binding File
If a server (audit client) is running with filters enabled (that is, DCEAUDITFILTERON was set), libaudit (which is linked to the server) obtains the server's binding information and stores it in the following:
/opt/dcelocal/var/audit/client/pid-of-server/update_binding_file
where pid-of-server is the process ID of the server.
If the server ends abnormally, this file must be removed manually. If this is not removed, you will receive an error message the next time you restart the server with DCEAUDITFILTERON. The message indicates that the audit daemon is unable to inform the audit client of filter updates:
unable to inform process
/opt/dcelocal/var/audit/client/pid-of-server/update_binding_file
about esl update.
You can also check for stale update binding files by checking what servers are running (for example, using ps -e) and comparing their process IDs with the pathnames of the update binding files. Because the pathname of these files contain a pid-of-server component, you can determine what files correspond to nonexistent servers.
Both the binding information file and the directory containing it (pid-of-server) must be removed.