Applies to: All versions of DirectAudit on all platforms
When DirectAudit Configured correctly but session are not recording and debug log shows:
Jun 22 10:22:28 amdc-admin-ux01 auth|security:debug cda.dash: DEBUG: Runlevel -1 is unacceptable,
dropping out. dash is not recording ...
Command "who -r" also returns nothing.
The root cause is that utmp is missing the system run level. This is not normal and this causes DirectAudit get the incorrect
run level and drop out.
A reboot should fix the "who -r" issue. And the DirectAudit will return normal once it gets the correct utmp information.