Re: Audit rotate
Yup that did it! Thanks Steve.
David Flatley CISSP
"To err is human. To really screw up requires the root password." -UNKNOWN
From: Steve Grubb <sgrubb(a)redhat.com>
To: David Flatley/Burlington/IBM@IBMUS,
Cc: linux-audit(a)redhat.com
Date: 01/08/2015 12:30 PM
Subject: Re: Audit rotate
On Thursday, January 08, 2015 12:17:40 PM David Flatley wrote:
I have "/sbin/service auditd rotate" in my scripts I
use on my Red
Hat
systems. But apparently on Suse it does not rotate the logs. When I
run
the
rotate command it comes back with what it can
do and rotate is not in there. Oh and it is auditd 1.8.0.30-1.
What I'm trying to say is that if the init script does not support it, then
all you need to do is send sigusr1 to auditd instead. Something like:
kill -USR1 `pidof auditd`
-Steve
From: Steve Grubb <sgrubb(a)redhat.com>
To: David Flatley/Burlington/IBM@IBMUS,
Cc: linux-audit(a)redhat.com
Date: 01/08/2015 11:46 AM
Subject: Re: Audit rotate
On Thursday, January 08, 2015 11:39:17 AM David Flatley wrote:
> Trying to setup Auditing on a Suse Server 11 SP3 with audit version
>
> 1.8.0.3. Apparently "audit rotate" is not available on this version of
> auditd? I know from past posts by Steve Grubb that logrotate does not
> work well rotating /var/log/audit/audit.log. So any thoughts on doing
audit
> logrotations?
"service auditd rotate" is simply a convenience for sending SIGUSR1 to
auditd.
That is all you need to do to force rotation of the logs.
-Steve