Re: space_left_action
On Thursday 30 July 2009 04:13:54 pm LC Bruzenak wrote:
Good news: When I set the space_left_action to syslog and crossed
the
boundary, I got a syslog message on the next audit event. Subsequent
events did not generate any further syslog messages.
Then I freed up disk space, sent in a few events for good measure
(thinking it would reset the flag) and once again filled the disk past
the threshold.
Bad news: I didn't get the message again.
Did you do a "service auditd resume" ?
Should this behavior have happened as I expected and another log
message
get into the messages log? Or as coded would the auditd need restart?
You shouldn't need to restart it, but you should tell it to resume.
-Steve