Linux-audit Digest, Vol 81, Issue 19

Thu Jun 30 17:21:50 UTC 2011

Why not set up a cron job that will copy the contents of the audit.log
file and secure files to archive on a weekly basis?  The files then
could be overwritten with the /dev/null file.  This will ensure that the
data is captured in the event the autorotate fails.

-----Original Message-----
From: linux-audit-bounces at redhat.com
[mailto:linux-audit-bounces at redhat.com] On Behalf Of
linux-audit-request at redhat.com
Sent: Thursday, June 30, 2011 12:00 PM
To: linux-audit at redhat.com
Subject: Linux-audit Digest, Vol 81, Issue 19

Send Linux-audit mailing list submissions to
	linux-audit at redhat.com

To subscribe or unsubscribe via the World Wide Web, visit
	https://www.redhat.com/mailman/listinfo/linux-audit
or, via email, send a message with subject or body 'help' to
	linux-audit-request at redhat.com

You can reach the person managing the list at
	linux-audit-owner at redhat.com

When replying, please edit your Subject line so it is more specific
than "Re: Contents of Linux-audit digest..."

Today's Topics:

   1. Audit rotate vs log rotate questions (Dole, Patrick A.)
   2. Re: Audit rotate vs log rotate questions (Steve Grubb)

----------------------------------------------------------------------

Message: 1
Date: Wed, 29 Jun 2011 18:10:44 -0500
From: "Dole, Patrick A." <Patrick.Dole at gd-ais.com>
To: "linux-audit at redhat.com" <linux-audit at redhat.com>
Subject: Audit rotate vs log rotate questions
Message-ID:

<5AE2942125A7394BB0DD5B9F32DF16921C0A1E10B9 at EADC01-MABPRD11.ad.gd-ais.co
m>

Content-Type: text/plain; charset="us-ascii"

Hi,
I was hoping you could provide some help with audit rotation vs.
logrotate

I'm running REL 5 SElinux
In my daily.con I have 2 cron jobs that I believe should manage the
'audit.log' file; audit.cron and logrotate

My audit.cron includes:
        service auditd rotate

Does this imply that the log always gets rotated, or is this based on
other conditional checks?
There are no other parameters in the audit.cron, so I don't see where
'max_log_size_action' or  'max_log_file_action' are checked.
Here is my auditd.conf

Also, I've read that cron doesn't like files with a period (.) in the
name - is this an issue with REL 5?

...

My Logrotate.conf is attached

My logrotate.d contains this file:

My basic questions is wouldn't the audit.cron, if it actually rotates
the log, preclude the logrotate from properly capturing the right log
files monthly?
Also, if I wanted to ensure no audit.log data ever gets deleted, could I
simply increase the 'rotate 12' statement to something like 'rotate 60'
to keep 5 years of data (provided the disk doesn't get full).

FYI, there is another utility that archives  the log files and gives the
user the option to delete files after they are archived.

A response within a couple days, if possible, would be great.
Thanks for your help.

Pat Dole
General Dynamics AIS

-------------- next part --------------
An HTML attachment was scrubbed...
URL:
<https://www.redhat.com/archives/linux-audit/attachments/20110629/04384e
df/attachment.html>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: auditd.conf
Type: application/octet-stream
Size: 924 bytes
Desc: auditd.conf
URL:
<https://www.redhat.com/archives/linux-audit/attachments/20110629/04384e
df/attachment.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: logrotate.conf
Type: application/octet-stream
Size: 529 bytes
Desc: logrotate.conf
URL:
<https://www.redhat.com/archives/linux-audit/attachments/20110629/04384e
df/attachment-0001.obj>
-------------- next part --------------
A non-text attachment was scrubbed...
Name: audit
Type: application/octet-stream
Size: 536 bytes
Desc: audit
URL:
<https://www.redhat.com/archives/linux-audit/attachments/20110629/04384e
df/attachment-0002.obj>

------------------------------

Message: 2
Date: Wed, 29 Jun 2011 19:55:05 -0400
From: Steve Grubb <sgrubb at redhat.com>
To: linux-audit at redhat.com
Cc: "Dole, Patrick A." <Patrick.Dole at gd-ais.com>
Subject: Re: Audit rotate vs log rotate questions
Message-ID: <201106291955.05848.sgrubb at redhat.com>
Content-Type: Text/Plain;  charset="iso-8859-15"

On Wednesday, June 29, 2011 07:10:44 PM Dole, Patrick A. wrote:
> I was hoping you could provide some help with audit rotation vs.
logrotate
> 
> I'm running REL 5 SElinux
> In my daily.con I have 2 cron jobs that I believe should manage the
> 'audit.log' file; audit.cron and logrotate
> 
> My audit.cron includes:
>         service auditd rotate
> 
> Does this imply that the log always gets rotated, or is this based on
other
> conditional checks? 

This issues a signal to auditd and it immediately rotates without any
checks. If it 
had rotated 1 second before you issue the rotate command because of file
size checks, 
it would even rotate the empty audit log.

> There are no other parameters in the audit.cron, so I
> don't see where 'max_log_size_action' or  'max_log_file_action' are
> checked. Here is my auditd.conf

The audit daemon will rotate based on size in addition to the cron job
unless you set 
max_log_size_action to ignore. This will make 1 big log file. If you
want it to rotate, 
set the max_log_size appropriately and choose another setting.

> Also, I've read that cron doesn't like files with a period (.) in the
name
> - is this an issue with REL 5?

Offhand I have never heard such an issue, but I would think there should
be something 
in the /var/log/messages file if it didn't like it.

> My basic questions is wouldn't the audit.cron, if it actually rotates
the
> log, preclude the logrotate from properly capturing the right log
files
> monthly? 

Logrotate should not directly rotate the audit logs. I don't supply a
logrotate 
configuration, but if I did it would call service auditd rotate so that
auditd performs 
the action. The audit daemon has to fulfill certain service guarantees
that logrotate 
does not care about. For example, if the audit disk partition gets full,
auditd can 
take the system down. Logrotate never will. So, you have to let auditd
do its own 
thing or you will have some issues.

> Also, if I wanted to ensure no audit.log data ever gets deleted,
> could I simply increase the 'rotate 12' statement to something like
> 'rotate 60' to keep 5 years of data (provided the disk doesn't get
full).

No, set the max_log_file_action to ignore. Note that this is a different
issue than what 
I described as making 1 big file.

> FYI, there is another utility that archives  the log files and gives
the
> user the option to delete files after they are archived.

There are probably people on this list that can tell you what they do. I
would suspect 
they have a custom cron job.

-Steve

------------------------------

--
Linux-audit mailing list
Linux-audit at redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit

End of Linux-audit Digest, Vol 81, Issue 19
*******************************************