Logging not resumed after low disk space

[Steve Grubb]

On Sunday, September 14, 2014 09:47:12 PM Laurent Bigonville wrote:
> Yesterday, I apparently run out of diskspace. Today I was wondering why
> there was no new audit trails in the logs.
> 
> systemctl status auditd showed me:
> 
> Audit daemon is low on disk space for logging
> Audit daemon is suspending logging due to low disk space.
> 
> Shouldn't the daemon resume the logging when free disk space is
> available again?

Its never done that. You need to send SIGUSR2 to auditd to get it to wake up. 
Normally this is done with "service auditd resume".

-Steve