The auditd daemon stops logging after deleting audit.log until auditd is restarted

Latitude · 06-20-2013, 11:55 AM

I am using Red Hat Enterprise Linux Server 6.1 and must copy audit.log files on a weekly basis to DVD and save them off on another audit log backup server. After clearing (deleting using rm -Rf) audit.log files and without restarting the auditd daemon, I noticed the server doesn't log any more events until I restart the auditd daemon (by rebooting). Is this typical of auditd to stop logging once audit.log has been deleted, requiring the daemon to be restarted?

unSpawn · 06-20-2013, 01:05 PM

Processes usually don't agree with you deleting open files without closing the file descriptor properly. On top of that the auditd service comes with its own log rotation options (as in maybe use those instead). And RHEL 6 has been at Update 4 for some time now.

jpollard · 06-20-2013, 03:10 PM

I believe you are supposed to send auditd a "SIGUSR1" signal to tell it to rotate logs. You can then do whatever you want to the old log.