I have a need to do two things when a disk space limit is reached and I am wondering if that can be accomplished.  Notionally the auditd.conf syntax would be something like:

space_left_action = SYSLOG, email

admin_space_left_action = SYSLOG, email

so I would get a SYSLOG event (which would trigger an alert on the audit collector) and an email as well to maximize the chances of viewing the alert in a timely manner.

I didn't see anything in the documentation one way or the other, so there any way to get this functionality out of auditd?

Thanks,

Ed Christiansen