audit log still getting rotated even with max_log_file_action = ignore?
Steve Grubb
sgrubb at redhat.com
Fri Nov 6 19:12:52 UTC 2015
On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote:
> On 11/02/2015 03:32 PM, Steve Grubb wrote:
> > I took a quick look at the code. I can't see how this is happening
> > unless auditd is receiving a SIGUSR1 signal. You might want to put
> > some syslog calls in to auditd-event.c log when auditd gets told to
> > rotate so that it can be correlated to other system activities. -Steve
>
> Hi Steve,
>
> The cron script i mention below does use "service auditd rotate", which
> does send a SIGUSR1. But these rotations are happening outside the time
> frame when that cron job runs.
Can you find any other cron job running around that time?
> Additionally, they seem to rotate around when the log file reaches about
> 90MB. It almost seems like there's some default behavior?
The settings to note in your email are these:
num_logs = 5
max_log_file = 6
max_log_file_action = ignore
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
This means you would have 6 log files that 5 MB each. However, the max_log_file
action says ignore.
> I was wondering if maybe my syntax in the config file was wrong and auditd was
> ignoring my setting and just using defaults?
It might be that you are hitting the admin_space_left_action which runs
remove_oldest_audit_log. That is my only guess. Does the math work out for
partition size - size of all logs being approximayely 50MB? If so, this is
your problem and you might need a bigger partition.
But based on a quick review of the man page, you might set num_logs = 0. That
is supposed to disable rotating as long as max_log_size_action != rotate. You
have ignore, so that should work if you don't have the problem noted above.
-Steve
> >> I have a cron job in /etc/cron.daily/auditd that I use to rotate +
> >> compress the audit logs, but this is not what is causing the audit log
> >> rotation.
> >>
> >> Is there another setting I must set in order for it to not automatically
> >> rotate the audit log? How do I achieve the desired effect, where the
> >> audit log is only rotated when my cron script runs?
More information about the Linux-audit
mailing list