* Logging not resumed after low disk space
@ 2014-09-14 19:47 Laurent Bigonville
2014-09-15 14:34 ` Steve Grubb
0 siblings, 1 reply; 2+ messages in thread
From: Laurent Bigonville @ 2014-09-14 19:47 UTC (permalink / raw)
To: linux-audit
Hello,
Yesterday, I apparently run out of diskspace. Today I was wondering why
there was no new audit trails in the logs.
systemctl status auditd showed me:
Audit daemon is low on disk space for logging
Audit daemon is suspending logging due to low disk space.
Shouldn't the daemon resume the logging when free disk space is
available again?
I had to restart the daemon completely as reloading it was not enough.
Cheers,
Laurent Bigonville
^ permalink raw reply [flat|nested] 2+ messages in thread
* Re: Logging not resumed after low disk space
2014-09-14 19:47 Logging not resumed after low disk space Laurent Bigonville
@ 2014-09-15 14:34 ` Steve Grubb
0 siblings, 0 replies; 2+ messages in thread
From: Steve Grubb @ 2014-09-15 14:34 UTC (permalink / raw)
To: linux-audit
On Sunday, September 14, 2014 09:47:12 PM Laurent Bigonville wrote:
> Yesterday, I apparently run out of diskspace. Today I was wondering why
> there was no new audit trails in the logs.
>
> systemctl status auditd showed me:
>
> Audit daemon is low on disk space for logging
> Audit daemon is suspending logging due to low disk space.
>
> Shouldn't the daemon resume the logging when free disk space is
> available again?
Its never done that. You need to send SIGUSR2 to auditd to get it to wake up.
Normally this is done with "service auditd resume".
-Steve
^ permalink raw reply [flat|nested] 2+ messages in thread
end of thread, other threads:[~2014-09-15 14:34 UTC | newest]
Thread overview: 2+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2014-09-14 19:47 Logging not resumed after low disk space Laurent Bigonville
2014-09-15 14:34 ` Steve Grubb
This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.