Re: audit rotate question
On Wednesday 20 May 2009 02:37:01 pm LC Bruzenak wrote:
How can I tell when the rotate is complete so I can move the files
out?
Use ls -i /var/log/audit/audit.log and watch for the inode to change. Read it
first, rotate, and then read again. If you don't see progress after a certain
amount of time, you might want to check syslog for problems.
-Steve