Hi,

I was hoping you could provide some help with audit rotation vs. logrotate

 

I’m running REL 5 SElinux

In my daily.con I have 2 cron jobs that I believe should manage the ‘audit.log’ file; audit.cron and logrotate

 

My audit.cron includes:

        service auditd rotate

 

Does this imply that the log always gets rotated, or is this based on other conditional checks?

There are no other parameters in the audit.cron, so I don’t see where ‘max_log_size_action’ or  ‘max_log_file_action’ are checked.

Here is my auditd.conf

 

Also, I’ve read that cron doesn’t like files with a period (.) in the name – is this an issue with REL 5?

 

…

 

My Logrotate.conf is attached

 

My logrotate.d contains this file:

 

 

My basic questions is wouldn’t the audit.cron, if it actually rotates the log, preclude the logrotate from properly capturing the right log files monthly?

Also, if I wanted to ensure no audit.log data ever gets deleted, could I simply increase the ‘rotate 12’ statement to something like ‘rotate 60’ to keep 5 years of data (provided the disk doesn’t get full).

 

FYI, there is another utility that archives  the log files and gives the user the option to delete files after they are archived.

 

A response within a couple days, if possible, would be great.

Thanks for your help. 

 

Pat Dole

General Dynamics AIS