From mboxrd@z Thu Jan 1 00:00:00 1970 From: LC Bruzenak Subject: Re: Log rotation and client disconnects Date: Thu, 12 Aug 2010 10:57:20 -0500 Message-ID: <1281628640.3694.29.camel@lcb> References: <56567.128.63.24.134.1281373190.squirrel@webmail.umbc.edu> <201008091353.32210.sgrubb@redhat.com> <58805.128.63.24.134.1281621749.squirrel@webmail.umbc.edu> <201008121025.59525.sgrubb@redhat.com> <45921.128.63.24.134.1281626211.squirrel@webmail.umbc.edu> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx08.extmail.prod.ext.phx2.redhat.com [10.5.110.12]) by int-mx03.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id o7CFvfJ5020003 for ; Thu, 12 Aug 2010 11:57:41 -0400 Received: from mail.magitekltd.com (rrcs-24-242-137-197.sw.biz.rr.com [24.242.137.197]) by mx1.redhat.com (8.13.8/8.13.8) with ESMTP id o7CFvRcp022736 for ; Thu, 12 Aug 2010 11:57:28 -0400 In-Reply-To: <45921.128.63.24.134.1281626211.squirrel@webmail.umbc.edu> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: rshaw1@umbc.edu Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thu, 2010-08-12 at 11:16 -0400, rshaw1@umbc.edu wrote: > > On Thursday, August 12, 2010 10:02:29 am rshaw1@umbc.edu wrote: > >> I've discovered the issue since I sent it, anyway. If num_logs is set > >> to > >> 0, auditd will ignore explicit requests to rotate the logs. I guess > >> this > >> may be intentional, but it's unfortunate as num_logs caps at 99 and I > >> need > >> to keep 365 of them. > > > > Have you looked at the keep_logs option for max_log_file_action? > > I did, but the man page states that keep_logs is similar to rotate, so it > sounds like if I used this option, it would still rotate the log file if > it went above the max_log_file size, which I don't want to happen. I > suppose I could just set max_log_file to 99999 or something (if that's > supported). Typically, uncompressed log files for ~400 clients on the > central server end up being around 3-4Gb. > > Thanks for all the help so far; I think I'm almost there. > > --Ray Do you not want to rotate because of the time it takes? Yep, the keep_logs does a rotate without a limit. The max_log_file value is an unsigned long so it should take a very large number. However, in case there is a lot of auditing you are not prepared for, I'd suggest limiting the file size to 2GB. The rotate time should be similar regardless of the file size. BTW, in what a time period are you getting the 3-4GB amounts? Are you happy with the data you are getting - or maybe you could pare it down some with audit.rules tweaks on the senders? LCB. -- LC (Lenny) Bruzenak lenny@magitekltd.com