Re: Audit logs rotation problem

Hi all I've a got a problem on my audit log rotation. Because we've got a lot of logs on our server (a little bit of rules and lot of activities), we've decided to rotate logs every hours to compress, backup and delete them. I'm using the command "/etc/init.d/auditd rotate" to rotate them, no other commands. By the way we have some errors, sometimes logs are rotated twice. The rotation job was successful and we have as a result this compressed file : audit_20120507-0940--20120507-1040.log.gz The file contain in the firts line this information about the previous rotation at 9h40 type=DAEMON_ROTATE msg=audit(1336376401.094:8139): auditd sending auid=0 pid=20084 subj=root:system_r:initrc_t:s0 But we have a second file created a few seconds after the previous one named : audit_20120507-1040--20120507-1040.log.gz The first line contain this text : type=DAEMON_ROTATE msg=audit(1336380001.723:8140): auditd error getting usr1 info - no change, sending auid=? pid=? subj=? res=failed