From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: space_left_action syslog Date: Tue, 23 Feb 2016 11:25:55 -0500 Message-ID: <1549799.6vBbhpqkCg@x2> References: <3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7D@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7D@FRVDX103.fr01.awl.atosorigin.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Maupertuis Philippe List-Id: linux-audit@redhat.com On Tuesday, February 23, 2016 11:54:21 AM Maupertuis Philippe wrote: > The man page reads space_left_action : syslog means that it will issue a > warning to syslog. Please tell me where can I find an example of such a > message to look for it in the syslog ? https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L515 > Would the message be different for admin_space_left_action and > disk_full_action ? Yes for admin_space_left and disk full is here: https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L571 I suppose a distinction could be made between space_left and admin_space_left messages, but if you get either it needs attention right away. > When audispd is configured to send audit events to syslog would these > messages follow the same path. Auditd sends them to syslog directly. Because these are not events, audispd will never see them. -Steve > I would like to be able to separate these messages for an easy notice should > something go wrong.