Use logrotate for audit logs?

[leam hall]

On Wed, Oct 19, 2016 at 4:46 PM, Simon Sekidde <ssekidde at redhat.com> wrote:

> Hi Leam
>
> ----- Original Message -----
> > From: "leam hall" <leamhall at gmail.com>
> > To: linux-audit at redhat.com
> > Sent: Wednesday, October 19, 2016 3:26:23 PM
> > Subject: Use logrotate for audit logs?
> >
> > Is there any reason to not use logrotate for audit logs on RHEL 6? We'd
> like
> > to keep them fresh and compressed.
> >
>
> This was discussed a while back
>
> https://www.redhat.com/archives/linux-audit/2012-November/msg00008.html
>
> > Thanks!
> >
> > Leam
> >
> > --
> > Mind on a Mission
> >
> > --
> > Linux-audit mailing list
> > Linux-audit at redhat.com
> > https://www.redhat.com/mailman/listinfo/linux-audit
>
> --
> Simon Sekidde * Red Hat, Inc. * Tyson's Corner, VA
> gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E
>
>
Simon, thanks!

In this case, Steve talks about the system being taken down due to audit
logs filling up the volumes. When that's not the best idea for a server, it
looks like logrotate is a better choice.

Leam


-- 
Mind on a Mission <http://leamhall.blogspot.com/>
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20161020/383ec073/attachment.htm>