3:40 p.m.
I'm seeing my /var/log/audit/audit.log getting rotated (I find a audit.1
or audit.2, etc. file) even though I have max_log_file_action=ignore.
Here's the full auditd.conf:
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = hostname
max_log_file = 6
max_log_file_action = ignore
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
disk_full_action = exec /usr/local/bin/remove_oldest_audit_log
disk_error_action = SUSPEND
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
what am I missing?
I have a cron job in /etc/cron.daily/auditd that I use to rotate +
compress the audit logs, but this is not what is causing the audit log
rotation.
Is there another setting I must set in order for it to not automatically
rotate the audit log? How do I achieve the desired effect, where the
audit log is only rotated when my cron script runs?
Thanks,
Bond
5:32 p.m.
On Monday, November 02, 2015 01:40:17 PM Bond Masuda wrote:
I'm seeing my /var/log/audit/audit.log getting rotated (I find a
audit.1
or audit.2, etc. file) even though I have max_log_file_action=ignore.
Here's the full auditd.conf:
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = hostname
max_log_file = 6
max_log_file_action = ignore
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
disk_full_action = exec /usr/local/bin/remove_oldest_audit_log
disk_error_action = SUSPEND
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
what am I missing?
I took a quick look at the code. I can't see how this is happening unless
auditd is receiving a SIGUSR1 signal.
You might want to put some syslog calls in to auditd-event.c log when auditd
gets told to rotate so that it can be correlated to other system activities.
-Steve
I have a cron job in /etc/cron.daily/auditd that I use to rotate +
compress the audit logs, but this is not what is causing the audit log
rotation.
Is there another setting I must set in order for it to not automatically
rotate the audit log? How do I achieve the desired effect, where the
audit log is only rotated when my cron script runs?
12:07 p.m.
On 11/02/2015 03:32 PM, Steve Grubb wrote:
I took a quick look at the code. I can't see how this is
happening
unless auditd is receiving a SIGUSR1 signal. You might want to put
some syslog calls in to auditd-event.c log when auditd gets told to
rotate so that it can be correlated to other system activities. -Steve
Hi Steve,
The cron script i mention below does use "service auditd rotate", which
does send a SIGUSR1. But these rotations are happening outside the time
frame when that cron job runs. Additionally, they seem to rotate around
when the log file reaches about 90MB. It almost seems like there's some
default behavior? I was wondering if maybe my syntax in the config file
was wrong and auditd was ignoring my setting and just using defaults?
Bond
> I have a cron job in /etc/cron.daily/auditd that I use to rotate
+
> compress the audit logs, but this is not what is causing the audit log
> rotation.
>
> Is there another setting I must set in order for it to not automatically
> rotate the audit log? How do I achieve the desired effect, where the
> audit log is only rotated when my cron script runs?
1:12 p.m.
On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote:
On 11/02/2015 03:32 PM, Steve Grubb wrote:
> I took a quick look at the code. I can't see how this is happening
> unless auditd is receiving a SIGUSR1 signal. You might want to put
> some syslog calls in to auditd-event.c log when auditd gets told to
> rotate so that it can be correlated to other system activities. -Steve
Hi Steve,
The cron script i mention below does use "service auditd rotate", which
does send a SIGUSR1. But these rotations are happening outside the time
frame when that cron job runs.
Can you find any other cron job running around that time?
Additionally, they seem to rotate around when the log file reaches
about
90MB. It almost seems like there's some default behavior?
The settings to note in your email are these:
num_logs = 5
max_log_file = 6
max_log_file_action = ignore
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
This means you would have 6 log files that 5 MB each. However, the max_log_file
action says ignore.
I was wondering if maybe my syntax in the config file was wrong and
auditd was
ignoring my setting and just using defaults?
It might be that you are hitting the admin_space_left_action which runs
remove_oldest_audit_log. That is my only guess. Does the math work out for
partition size - size of all logs being approximayely 50MB? If so, this is
your problem and you might need a bigger partition.
But based on a quick review of the man page, you might set num_logs = 0. That
is supposed to disable rotating as long as max_log_size_action != rotate. You
have ignore, so that should work if you don't have the problem noted above.
-Steve
>> I have a cron job in /etc/cron.daily/auditd that I use to
rotate +
>> compress the audit logs, but this is not what is causing the audit log
>> rotation.
>>
>> Is there another setting I must set in order for it to not automatically
>> rotate the audit log? How do I achieve the desired effect, where the
>> audit log is only rotated when my cron script runs?
12:05 a.m.
On 11/06/2015 11:12 AM, Steve Grubb wrote:
On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote:
> On 11/02/2015 03:32 PM, Steve Grubb wrote:
>> I took a quick look at the code. I can't see how this is happening
>> unless auditd is receiving a SIGUSR1 signal. You might want to put
>> some syslog calls in to auditd-event.c log when auditd gets told to
>> rotate so that it can be correlated to other system activities. -Steve
> Hi Steve,
>
> The cron script i mention below does use "service auditd rotate", which
> does send a SIGUSR1. But these rotations are happening outside the time
> frame when that cron job runs.
Can you find any other cron job running around that time?
I'm still trying to hunt this down; haven't found anything thus far, but
its possible I could have missed something.
> Additionally, they seem to rotate around when the log file
reaches about
> 90MB. It almost seems like there's some default behavior?
The settings to note in your email are these:
num_logs = 5
max_log_file = 6
max_log_file_action = ignore
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
This means you would have 6 log files that 5 MB each. However, the max_log_file
action says ignore.
> I was wondering if maybe my syntax in the config file was wrong and auditd was
> ignoring my setting and just using defaults?
It might be that you are hitting the admin_space_left_action which runs
remove_oldest_audit_log. That is my only guess. Does the math work out for
partition size - size of all logs being approximayely 50MB? If so, this is
your problem and you might need a bigger partition.
I don't think that's
the case:
# df -h /var/log/audit/
Filesystem Size Used Avail Use% Mounted on
/dev/mapper/vg_system-lv_audit
1014M 413M 602M 41% /audit
But based on a quick review of the man page, you might set num_logs =
0. That
is supposed to disable rotating as long as max_log_size_action != rotate. You
have ignore, so that should work if you don't have the problem noted above.
-Steve
Ok, will try this and see if that unexpected rotation goes away.
Thanks,
Bond
3280
days inactive
3286
days old
linux-audit@lists.linux-audit.osci.io
4 comments
2 participants
participants (2)
-
Bond Masuda -
Steve Grubb