Re: Audit rotate

[Steve Grubb <sgrubb@redhat.com>]

On Thursday, January 08, 2015 12:17:40 PM David Flatley wrote:
>      I have "/sbin/service auditd rotate" in my scripts I use on my Red Hat
> systems. But apparently on Suse it does not rotate the logs. When I run the
> rotate command it comes back with what it can
> do and rotate is not in there. Oh and it is auditd 1.8.0.30-1.

What I'm trying to say is that if the init script does not support it, then 
all you need to do is send sigusr1 to auditd instead. Something like:

kill -USR1 `pidof auditd`

-Steve



> From:	Steve Grubb <sgrubb@redhat.com>
> To:	David Flatley/Burlington/IBM@IBMUS,
> Cc:	linux-audit@redhat.com
> Date:	01/08/2015 11:46 AM
> Subject:	Re: Audit rotate
> 
> On Thursday, January 08, 2015 11:39:17 AM David Flatley wrote:
> >     Trying to setup Auditing on a Suse Server 11 SP3 with audit version
> > 
> > 1.8.0.3. Apparently "audit rotate" is not available on this version of
> > auditd? I know from past posts by Steve Grubb that logrotate does not
> > work well rotating /var/log/audit/audit.log. So any thoughts on doing
> 
> audit
> 
> > logrotations?
> 
> "service auditd rotate" is simply a convenience for sending SIGUSR1 to
> auditd.
> That is all you need to do to force rotation of the logs.
> 
> -Steve