Re: audit log still getting rotated even with max_log_file_action = ignore?

On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote: > On 11/02/2015 03:32 PM, Steve Grubb wrote: >> I took a quick look at the code. I can't see how this is happening >> unless auditd is receiving a SIGUSR1 signal. You might want to put >> some syslog calls in to auditd-event.c log when auditd gets told to >> rotate so that it can be correlated to other system activities. -Steve > Hi Steve, > > The cron script i mention below does use "service auditd rotate", which > does send a SIGUSR1. But these rotations are happening outside the time > frame when that cron job runs. Can you find any other cron job running around that time?

> Additionally, they seem to rotate around when the log file reaches about > 90MB. It almost seems like there's some default behavior? The settings to note in your email are these: num_logs = 5 max_log_file = 6 max_log_file_action = ignore admin_space_left = 50 admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log This means you would have 6 log files that 5 MB each. However, the max_log_file action says ignore. > I was wondering if maybe my syntax in the config file was wrong and auditd was > ignoring my setting and just using defaults? It might be that you are hitting the admin_space_left_action which runs remove_oldest_audit_log. That is my only guess. Does the math work out for partition size - size of all logs being approximayely 50MB? If so, this is your problem and you might need a bigger partition.

But based on a quick review of the man page, you might set num_logs = 0. That is supposed to disable rotating as long as max_log_size_action != rotate. You have ignore, so that should work if you don't have the problem noted above. -Steve