On Wed, Oct 19, 2016 at 4:46 PM, Simon Sekidde <ssekidde@redhat.com> wrote:
Hi Leam

----- Original Message -----
> From: "leam hall" <leamhall@gmail.com>
> To: linux-audit@redhat.com
> Sent: Wednesday, October 19, 2016 3:26:23 PM
> Subject: Use logrotate for audit logs?
>
> Is there any reason to not use logrotate for audit logs on RHEL 6? We'd like
> to keep them fresh and compressed.
>

This was discussed a while back

https://www.redhat.com/archives/linux-audit/2012-November/msg00008.html

> Thanks!
>
> Leam
>
> --
> Mind on a Mission
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit

--
Simon Sekidde * Red Hat, Inc. * Tyson's Corner, VA
gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E


Simon, thanks!

In this case, Steve talks about the system being taken down due to audit logs filling up the volumes. When that's not the best idea for a server, it looks like logrotate is a better choice.

Leam


--
Mind on a Mission