audit log still getting rotated even with max_log_file_action = ignore?

[Bond Masuda]

On 11/06/2015 11:12 AM, Steve Grubb wrote:
> On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote:
>> On 11/02/2015 03:32 PM, Steve Grubb wrote:
>>> I took a quick look at the code. I can't see how this is happening
>>> unless auditd is receiving a SIGUSR1 signal. You might want to put
>>> some syslog calls in to auditd-event.c log when auditd gets told to
>>> rotate so that it can be correlated to other system activities. -Steve
>> Hi Steve,
>>
>> The cron script i mention below does use "service auditd rotate", which
>> does send a SIGUSR1. But these rotations are happening outside the time
>> frame when that cron job runs.
> Can you find any other cron job running around that time?
>
I'm still trying to hunt this down; haven't found anything thus far, but
its possible I could have missed something.
>> Additionally, they seem to rotate around when the log file reaches about
>> 90MB. It almost seems like there's some default behavior?
> The settings to note in your email are these:
>
> num_logs = 5
> max_log_file = 6
> max_log_file_action = ignore
> admin_space_left = 50
> admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
>
> This means you would have 6 log files that 5 MB each. However, the max_log_file 
> action says ignore.
>
>
>> I was wondering if maybe my syntax in the config file was wrong and auditd was
>> ignoring my setting and just using defaults?
> It might be that you are hitting the admin_space_left_action which runs 
> remove_oldest_audit_log. That is my only guess. Does the math work out for 
> partition size - size of all logs being approximayely  50MB? If so, this is 
> your problem and you might need a bigger partition.
I don't think that's the case:

# df -h /var/log/audit/
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_system-lv_audit
                     1014M  413M  602M  41% /audit

> But based on a quick review of the man page, you might set num_logs = 0. That 
> is supposed to disable rotating as long as max_log_size_action != rotate. You 
> have ignore, so that should work if you don't have the problem noted above.
>
> -Steve
>
Ok, will try this and see if that unexpected rotation goes away.

Thanks,
Bond