auditd.conf avctions
by Christiansen, Ed - 0992 - MITLL
I have a need to do two things when a disk space limit is reached and I am
wondering if that can be accomplished. Notionally the auditd.conf syntax
would be something like:
space_left_action = SYSLOG, email
admin_space_left_action = SYSLOG, email
so I would get a SYSLOG event (which would trigger an alert on the audit
collector) and an email as well to maximize the chances of viewing the alert
in a timely manner.
I didn't see anything in the documentation one way or the other, so there
any way to get this functionality out of auditd?
Thanks,
Ed Christiansen