Re: audit log still getting rotated even with max_log_file_action = ignore?
On 11/02/2015 03:32 PM, Steve Grubb wrote:
I took a quick look at the code. I can't see how this is
happening
unless auditd is receiving a SIGUSR1 signal. You might want to put
some syslog calls in to auditd-event.c log when auditd gets told to
rotate so that it can be correlated to other system activities. -Steve
Hi Steve,
The cron script i mention below does use "service auditd rotate", which
does send a SIGUSR1. But these rotations are happening outside the time
frame when that cron job runs. Additionally, they seem to rotate around
when the log file reaches about 90MB. It almost seems like there's some
default behavior? I was wondering if maybe my syntax in the config file
was wrong and auditd was ignoring my setting and just using defaults?
Bond
> I have a cron job in /etc/cron.daily/auditd that I use to rotate
+
> compress the audit logs, but this is not what is causing the audit log
> rotation.
>
> Is there another setting I must set in order for it to not automatically
> rotate the audit log? How do I achieve the desired effect, where the
> audit log is only rotated when my cron script runs?