Re: space_left_action syslog
On Tuesday, February 23, 2016 11:54:21 AM Maupertuis Philippe wrote:
The man page reads space_left_action : syslog means that it will
issue a
warning to syslog. Please tell me where can I find an example of such a
message to look for it in the syslog ?
https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L515
Would the message be different for admin_space_left_action and
disk_full_action ?
Yes for admin_space_left and disk full is here:
https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L571
I suppose a distinction could be made between space_left and
admin_space_left messages, but if you get either it needs attention right
away.
When audispd is configured to send audit events to syslog would
these
messages follow the same path.
Auditd sends them to syslog directly. Because these are not events, audispd
will never see them.
-Steve
I would like to be able to separate these messages for an easy notice
should
something go wrong.