Re: Use logrotate for audit logs?
On Thu, Oct 20, 2016 at 7:32 AM, leam hall <leamhall(a)gmail.com> wrote:
In this case, Steve talks about the system being taken down due to
audit
logs filling up the volumes. When that's not the best idea for a server, it
looks like logrotate is a better choice.
No. You misunderstand.
auditd CAN be configured to take the system down when there's no more space
for audit logs; it does not do this by default. (See auditd.conf's various
*_action directives, e.g., disk_full_action.) There is IMHO very little
reason to switch to using logrotate. Please check out `man auditd.conf`.
Attachments:
- attachment.html (text/html — 920 bytes)