Audit log compression - Linux-audit - Linux-Audit List Archives

2024

2023

2022

2021

2020

2019

2018

2017

2016

2015

2014

2013

2012

2011

2010

2009

2008

2007

2006

2005

2004

Audit log compression

[PATCH -next v3] cred:...

[RFC PATCH ghak10 v2 0/5] audit:...

Wyatt, Curtis R

Wednesday, 27 June 2018 Wed, 27 Jun '18

12:11 p.m.

What is the best/preferred method for compressing audit logs? I was thinking logrotate wouldn't work because auditd usually rotates it's own logs and is smarter about rotating logs (I.e., based on log size as opposed to having to wait before log rotate is kicked off). Thanks

Attachments:

attachment.html (text/html — 572 bytes)

Reply

Show replies by date

leam hall

Wednesday, 27 June Wed, 27 Jun

12:14 p.m.

logrotate can be configured nicely. First big step is looking at what's going into the logs though. Are you logging at INFO level and do you need that. I've seen that be 90% or more of the log entries. On Wed, Jun 27, 2018 at 1:11 PM, Wyatt, Curtis R <Curtis.Wyatt(a)gd-ms.com> wrote:

What is the best/preferred method for compressing audit logs? I was thinking logrotate wouldn't work because auditd usually rotates it's own logs and is smarter about rotating logs (I.e., based on log size as opposed to having to wait before log rotate is kicked off). Thanks -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

Reply

2369

days inactive

2369

days old

linux-audit@lists.linux-audit.osci.io

Manage subscription

1 comments

2 participants

tags (0)

participants (2)

leam hall
Wyatt, Curtis R