[SOLVED] Logrotate - what is rotating /var/log/audit/audit.log?

veeruk101 · 11-03-2011, 09:59 AM

/var/log/audit/audit.log seems to be getting rotated, but I'm not sure what's causing it because there doesn't seem to be configuration for it in any logrotate config files.

I'd like to create my own logrotate rules to rotate it when it hits a certain size (because the files are too large for my liking), but I don't know where to change it... I could ADD a logrotate configuration for audit.log but I don't know how it would interfere with the existing log rotation rule for this log, wherever it is.

MensaWater · 11-03-2011, 02:18 PM

/etc/audit/auditd.conf has the rotation rules for this log. The rotation is size based rather than time based by default.

Typing "man auditd.conf" will give you details on how to configure the rules.

veeruk101 · 11-03-2011, 07:36 PM

I'd like logrotate to manage the rotation, so I'm setting max_log_file_action to IGNORE instead of ROTATE, and adding a rule in logrotate for audit.log. I hope that does it.

unSpawn · 11-03-2011, 07:53 PM

Quote:

Originally Posted by veeruk101

I'd like to create my own logrotate rules to rotate it when it hits a certain size (because the files are too large for my liking)

Using logrotate only due to file size may not address the actual cause. Depending on what logging is produced versus what is required I suggest tweaking your current rule set before settling for a panacea.