<html><body><div>Hi Andrew,</div><div><br></div><div>To add to Steve Grubb's response, part of the configuration should also include an option to notify the administrator via Email when the partition is at 90% capacity. Of course, this can be adjusted to better suit your requirements (i.e. 90% on a Friday night might be too late).</div><div><br></div><div>Another solution is to use Steve's logrotate script. We made some minor additions to it so that the script not only rotates the audit log every 24-hours, but then it gets compressed using BZIP2 and moved to a larger partition under an archive folder (i.e. /opt/AUDIT_ARCHIVE) and time stamped. This way your partition should rarely if ever fill up.</div><div><br></div><div>Cheers,</div><div class="x-apple-signature"><pre style="font-family: 'Helvetica Neue', Helvetica, sans-serif; font-size: 15px; white-space: pre-wrap; word-wrap: break-word;">Paul M. Whitney
E-mail: paul.whitney@mac.com
Sent from my browser.
</pre></div><div><br>On Apr 16, 2015, at 10:52 AM, Steve Grubb <sgrubb@redhat.com> wrote:<br><br></div><div><blockquote type="cite"><div class="msg-quote"><div class="_stretch"><span class="body-text-content"><span class="body-text-content">On Thursday, April 16, 2015 08:29:23 AM Andrew Ruch wrote:<br></span></span><blockquote class="quoted-plain-text" type="cite">Hello,</blockquote><blockquote class="quoted-plain-text" type="cite"><br></blockquote><blockquote class="quoted-plain-text" type="cite">We have a RHEL6 system with the disk_full_action set to HALT. I'm</blockquote><blockquote class="quoted-plain-text" type="cite">working on procedures for what to do if this case occurs. When the log</blockquote><blockquote class="quoted-plain-text" type="cite">partition fills up, the system shuts down. However, the system will</blockquote><blockquote class="quoted-plain-text" type="cite">not boot after this because as soon as auditd tries to start, the</blockquote><blockquote class="quoted-plain-text" type="cite">system immediately shuts down again. What are the options for</blockquote><blockquote class="quoted-plain-text" type="cite">recovering after this happens? I've come up with two:</blockquote><span class="body-text-content"><span class="body-text-content"><br>Normally, I would think that system maintenance for a situation like this is <br>to boot the computer into Single User Mode. You should have switched the <br>system over to using sulogin as the shell for single user mode. This way its <br>password protected. Then once in, do what you need to archive and make room <br>again.<br><br><br></span></span><blockquote class="quoted-plain-text" type="cite">1) Stop the boot process at grub and disable audit by adding a kernel</blockquote><blockquote class="quoted-plain-text" type="cite">parameter 'audit=0'.</blockquote><span class="body-text-content"><span class="body-text-content"><br>If you don't use single user mode, then there is the risk of someone doing <br>something while the audit system can't record anything. You probably don't <br>want that possibility either.<br><br><br></span></span><blockquote class="quoted-plain-text" type="cite">2) If grub timeout is 0, use a live CD to access the audit partition.</blockquote><span class="body-text-content"><span class="body-text-content"><br>This would work also, but Single User Mode is so much easier. :-)<br> <br> <br></span></span><blockquote class="quoted-plain-text" type="cite">I'm sure there are some variations on option 1 using an interactive</blockquote><blockquote class="quoted-plain-text" type="cite">boot. Are there any other options I missed, especially if grub timeout</blockquote><blockquote class="quoted-plain-text" type="cite">has been set to 0?</blockquote><span class="body-text-content"><br>I wouldn't set it to 0. You can make it short like 2 or 3. But you need to be <br>able to get into the editor to tell it 'S' for single user mode.<br><br>-Steve<br><br>--<br>Linux-audit mailing list<br><a href="mailto:Linux-audit@redhat.com" onclick="return false;">Linux-audit@redhat.com</a><br><a href="https://www.redhat.com/mailman/listinfo/linux-audit">https://www.redhat.com/mailman/listinfo/linux-audit</a><br></span></div></div></blockquote></div></body></html>