audit rotate question

audit rotate question

[LC Bruzenak]

If I do a "service auditd rotate" it just sends the auditd the USR1
signal which means "start the rotation".

On a slow/burdened machine with many files this is not immediate.

I am trying to run a cron job which will :

mkdir /var/log/audit-archive/
service auditd rotate
mv /var/log/audit/audit.log.* /var/log/audit-archive/

But the files listed are not through rotating so it has issues (file not
found, leaves behind the last one rotated - audit.log.1, etc.).

How can I tell when the rotate is complete so I can move the files out?
I'm sure there is a simple way but I cannot see it.

Thx,
LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com

Re: audit rotate question

[John Dennis]

LC Bruzenak wrote:
> If I do a "service auditd rotate" it just sends the auditd the USR1
> signal which means "start the rotation".
> 
> On a slow/burdened machine with many files this is not immediate.
> 
> I am trying to run a cron job which will :
> 
> mkdir /var/log/audit-archive/
> service auditd rotate
> mv /var/log/audit/audit.log.* /var/log/audit-archive/
> 
> But the files listed are not through rotating so it has issues (file not
> found, leaves behind the last one rotated - audit.log.1, etc.).
> 
> How can I tell when the rotate is complete so I can move the files out?
> I'm sure there is a simple way but I cannot see it.

Set an inotify watch on the *directory*, you'll be able to see when the
files are renamed and created. The package inotify-tools may be of help,
there are also inotify python bindings. If neither of those work for you
I can send C you code which will perform the inotify watch.

-- 
John Dennis <jdennis@redhat.com>

Looking to carve out IT costs?
www.redhat.com/carveoutcosts/

Re: audit rotate question

[Steve Grubb]

On Wednesday 20 May 2009 02:37:01 pm LC Bruzenak wrote:
> How can I tell when the rotate is complete so I can move the files out?

Use ls -i /var/log/audit/audit.log and watch for the inode to change. Read it 
first, rotate, and then read again. If you don't see progress after a certain 
amount of time, you might want to check syslog for problems.

-Steve

Re: audit rotate question

[LC Bruzenak]

Thanks John and Steve!

LCB.

-- 
LC (Lenny) Bruzenak
lenny@magitekltd.com