Re: Audit rotate vs log rotate questions
On Wednesday, June 29, 2011 07:10:44 PM Dole, Patrick A. wrote:
I was hoping you could provide some help with audit rotation vs.
logrotate
I'm running REL 5 SElinux
In my daily.con I have 2 cron jobs that I believe should manage the
'audit.log' file; audit.cron and logrotate
My audit.cron includes:
service auditd rotate
Does this imply that the log always gets rotated, or is this based on other
conditional checks?
This issues a signal to auditd and it immediately rotates without any checks. If it
had rotated 1 second before you issue the rotate command because of file size checks,
it would even rotate the empty audit log.
There are no other parameters in the audit.cron, so I
don't see where 'max_log_size_action' or 'max_log_file_action' are
checked. Here is my auditd.conf
The audit daemon will rotate based on size in addition to the cron job unless you set
max_log_size_action to ignore. This will make 1 big log file. If you want it to rotate,
set the max_log_size appropriately and choose another setting.
Also, I've read that cron doesn't like files with a period
(.) in the name
- is this an issue with REL 5?
Offhand I have never heard such an issue, but I would think there should be something
in the /var/log/messages file if it didn't like it.
My basic questions is wouldn't the audit.cron, if it actually
rotates the
log, preclude the logrotate from properly capturing the right log files
monthly?
Logrotate should not directly rotate the audit logs. I don't supply a logrotate
configuration, but if I did it would call service auditd rotate so that auditd performs
the action. The audit daemon has to fulfill certain service guarantees that logrotate
does not care about. For example, if the audit disk partition gets full, auditd can
take the system down. Logrotate never will. So, you have to let auditd do its own
thing or you will have some issues.
Also, if I wanted to ensure no audit.log data ever gets deleted,
could I simply increase the 'rotate 12' statement to something like
'rotate 60' to keep 5 years of data (provided the disk doesn't get full).
No, set the max_log_file_action to ignore. Note that this is a different issue than what
I described as making 1 big file.
FYI, there is another utility that archives the log files and gives
the
user the option to delete files after they are archived.
There are probably people on this list that can tell you what they do. I would suspect
they have a custom cron job.
-Steve