Re: audit-0.6.7 released
Mounir Bsaibes
Linux Security
Tel: (512) 838-1301
Cell: (512) 762-9957
Fax: (512) 838-8858
e-mail: bsaibes(a)us.ibm.com
linux-audit-bounces(a)redhat.com wrote on 03/10/2005 12:29:53 PM:
On Thursday 10 March 2005 13:22, Mounir Bsaibes wrote:
> Can you please tell us how this option works with the xxx_space_left
> options.
They are separate checks. One check is for the size of the file, the
other
check is for the amount of space left. They do not interfere with
each
other.
> What happens when the last audit.log.x is full do you start on
audit.log
> again.
I always write to whatever the name was given by the admin. I followthe
same
algorithm as logrotate so that its familiar.
Log rotation is critical for the casual user so that they can set aside
a
certain amount of diskspace and know audit isn't going to fill
their
drive.
Thanks Steve,
Now, the question: Is there any additional requirement to satisfy CAPP
in this situation? Or, this is totally acceptable; since the file
size can be set large enough.
Mounir
-Steve Grubb
--
Linux-audit mailing list
Linux-audit(a)redhat.com
http://www.redhat.com/mailman/listinfo/linux-audit