Use logrotate for audit logs?
- First Post
- Replies
- Stats
-
Go to
- ----- 2024 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2023 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2022 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2021 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2020 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2019 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2018 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2017 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2016 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2015 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2014 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2013 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2012 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2011 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2010 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2009 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2008 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2007 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2006 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2005 -----
- December
- November
- October
- September
- August
- July
- June
- May
- April
- March
- February
- January
- ----- 2004 -----
- December
- November
- October
- September
- August
Is there any reason to not use logrotate for audit logs on RHEL 6? We'd
like to keep them fresh and compressed.
Thanks!
Leam
--
Mind on a Mission <http://leamhall.blogspot.com/>
Attachments:
- attachment.html (text/html — 395 bytes)
Hi Leam
----- Original Message -----
From: "leam hall" <leamhall(a)gmail.com>
To: linux-audit(a)redhat.com
Sent: Wednesday, October 19, 2016 3:26:23 PM
Subject: Use logrotate for audit logs?
Is there any reason to not use logrotate for audit logs on RHEL 6? We'd like
to keep them fresh and compressed.
This was discussed a while back
https://www.redhat.com/archives/linux-audit/2012-November/msg00008.html
Thanks!
Leam
--
Mind on a Mission
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
--
Simon Sekidde * Red Hat, Inc. * Tyson's Corner, VA
gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E
On Wed, Oct 19, 2016 at 4:46 PM, Simon Sekidde <ssekidde(a)redhat.com> wrote:
Hi Leam
----- Original Message -----
> From: "leam hall" <leamhall(a)gmail.com>
> To: linux-audit(a)redhat.com
> Sent: Wednesday, October 19, 2016 3:26:23 PM
> Subject: Use logrotate for audit logs?
>
> Is there any reason to not use logrotate for audit logs on RHEL 6? We'd
like
> to keep them fresh and compressed.
>
This was discussed a while back
https://www.redhat.com/archives/linux-audit/2012-November/msg00008.html
> Thanks!
>
> Leam
>
> --
> Mind on a Mission
>
> --
> Linux-audit mailing list
> Linux-audit(a)redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
--
Simon Sekidde * Red Hat, Inc. * Tyson's Corner, VA
gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E
Simon, thanks!
In this case, Steve talks about the system being taken down due to audit
logs filling up the volumes. When that's not the best idea for a server, it
looks like logrotate is a better choice.
Leam
--
Mind on a Mission <http://leamhall.blogspot.com/>
On Thu, Oct 20, 2016 at 7:32 AM, leam hall <leamhall(a)gmail.com> wrote:
In this case, Steve talks about the system being taken down due to
audit
logs filling up the volumes. When that's not the best idea for a server, it
looks like logrotate is a better choice.
No. You misunderstand.
auditd CAN be configured to take the system down when there's no more space
for audit logs; it does not do this by default. (See auditd.conf's various
*_action directives, e.g., disk_full_action.) There is IMHO very little
reason to switch to using logrotate. Please check out `man auditd.conf`.
2993
days inactive
2994
days old
linux-audit@lists.linux-audit.osci.io
3 comments
3 participants
tags (0)
participants (3)
-
leam hall -
Ryan Sawhill -
Simon Sekidde