[rhn-users] Is anything supposed to clean up /var/log/audit.d?
Corné Beerse
cbeerse at lycos.nl
Fri Jan 28 14:50:41 UTC 2005
Rich Graves wrote:
> We have a system with over 15GB in /var/log/audit.d.
>
> The LAuS auditd/audbin processes cooperate to rotate individual logfiles,
> but there doesn't seem to be any system for removing old audit files.
>
> I think our approach is going to be to squelch entries for the
> known process creating all the entries, but how do others deal with this?
I just stopped audit (`/etc/init.d/audit stop` and `chkconfig audit off`). That
gives me an other problem, some other services seem to depend on it.
I think there are 2 'best practices':
- remove audit from the system. This will also remove packages that depend on it
and maybe have other implications.
- reconfigure audit to stop auditing.
If someone has success with one of these 2 steps (or an other idea to avoid
filling /var/log/audit) please reply to the list, I think there are more of us
who want to know.
CBee
More information about the rhn-users
mailing list