Hi all
I've a got a problem on my audit log rotation.
Because we've got a lot of logs on our server (a little bit of rules
and lot of activities), we've decided to rotate logs every hours to
compress, backup and delete them.
I'm using the command "/etc/init.d/auditd rotate" to rotate them, no
other commands.
By the way we have some errors, sometimes logs are rotated twice.
The rotation job was successful and we have as a result this
compressed file :
audit_20120507-0940--20120507-1040.log.gz
The file contain in the firts line this information about the previous
rotation at 9h40
type=DAEMON_ROTATE msg=audit(1336376401.094:8139): auditd sending
auid=0 pid=20084 subj=root:system_r:initrc_t:s0
But we have a second file created a few seconds after the previous one
named : audit_20120507-1040--20120507-1040.log.gz
The first line contain this text :
type=DAEMON_ROTATE msg=audit(1336380001.723:8140): auditd error
getting usr1 info - no change, sending auid=? pid=? subj=? res=failed
My search on the internet doesn't give me any clues about a solution.
Does anybody have any clues ?
I'm using RH ES 5.7 with auditd 1.7.18
Regards.