Setting audit logs as different group ID

Ameel Kamboh akamboh at nortel.com
Fri Aug 3 15:08:28 UTC 2007


Is there a way to have the audit log files be a member of a different
group (other then root)
Currently I am seeing this:
-rw-r----- 1 root root       837716 Aug  3 10:06 audit.log
-r--r----- 1 root root     52428840 Aug  3 08:24 audit.log.1
-r--r----- 1 root root      5242936 Jul 24 10:56 audit.log.2
-r--r----- 1 root ntsecadm  5242911 Jul 23 15:33 audit.log.3

I had originally set the group for /var/log/audit/audit.log to
root:ntsecadm during post install or RH5
After the audit logs rotate the new files take on root:root ownership, I
would like them to also be root:ntsecadm

Can this be set in audit.conf?
Ameel Kamboh
SIP Core Network and Security 
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh at techtrial.com
email: akamboh at nortel.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070803/805d5dde/attachment.htm>


More information about the Linux-audit mailing list