From mboxrd@z Thu Jan 1 00:00:00 1970 From: Maupertuis Philippe Subject: space_left_action syslog Date: Tue, 23 Feb 2016 11:54:21 +0100 Message-ID: <3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7D@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============7730357797812603162==" Return-path: Received: from mx1.redhat.com (ext-mx02.extmail.prod.ext.phx2.redhat.com [10.5.110.26]) by int-mx10.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id u1NAsRi2016941 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Tue, 23 Feb 2016 05:54:27 -0500 Received: from smtppost.atos.net (smtppost.atos.net [193.56.114.164]) by mx1.redhat.com (Postfix) with ESMTPS id 8E0DB8E254 for ; Tue, 23 Feb 2016 10:54:25 +0000 (UTC) Content-Language: fr-FR List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============7730357797812603162== Content-Language: fr-FR Content-Type: multipart/alternative; boundary="_000_3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7DFRVDX103fr01a_" --_000_3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7DFRVDX103fr01a_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Hi list, The man page reads space_left_action : syslog means that it will issue a wa= rning to syslog. Please tell me where can I find an example of such a message to look for it= in the syslog ? Would the message be different for admin_space_left_action and disk_full_ac= tion ? When audispd is configured to send audit events to syslog would these messa= ges follow the same path. I would like to be able to separate these messages for an easy notice shoul= d something go wrong. Regards. Philippe ________________________________ Ce message et les pi?ces jointes sont confidentiels et r?serv?s ? l'usage e= xclusif de ses destinataires. Il peut ?galement ?tre prot?g? par le secret = professionnel. Si vous recevez ce message par erreur, merci d'en avertir im= m?diatement l'exp?diteur et de le d?truire. L'int?grit? du message ne pouva= nt ?tre assur?e sur Internet, la responsabilit? de Worldline ne pourra ?tre= recherch?e quant au contenu de ce message. Bien que les meilleurs efforts = soient faits pour maintenir cette transmission exempte de tout virus, l'exp= ?diteur ne donne aucune garantie ? cet ?gard et sa responsabilit? ne saurai= t ?tre recherch?e pour tout dommage r?sultant d'un virus transmis. This e-mail and the documents attached are confidential and intended solely= for the addressee; it may also be privileged. If you receive this e-mail i= n error, please notify the sender immediately and destroy it. As its integr= ity cannot be secured on the Internet, the Worldline liability cannot be tr= iggered for the message content. Although the sender endeavours to maintain= a computer virus-free network, the sender does not warrant that this trans= mission is virus-free and will not be liable for any damages resulting from= any virus transmitted. --_000_3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7DFRVDX103fr01a_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

Hi list,

The man page reads space_left_a= ction : syslog means that it will issue a warning to syslog.

Please tell me where can I find= an example of such a message to look for it in the syslog ?

Would the message be different = for admin_space_left_action and disk_full_action ?

When audispd is configured to s= end audit events to syslog would these messages follow the same path.<= /o:p>

I would like to be able to sepa= rate these messages for an easy notice should something go wrong.

 

Regards.

Philippe



Ce message et les pièces jointes sont confidentiels et réserv= és à l'usage exclusif de ses destinataires. Il peut ég= alement être protégé par le secret professionnel. Si vo= us recevez ce message par erreur, merci d'en avertir immédiatement l= 'expéditeur et de le détruire. L'intégrité du message ne pouvant êtr= e assurée sur Internet, la responsabilité de Worldline ne pou= rra être recherchée quant au contenu de ce message. Bien que l= es meilleurs efforts soient faits pour maintenir cette transmission exempte= de tout virus, l'expéditeur ne donne aucune garantie à cet égard et = sa responsabilité ne saurait être recherchée pour tout = dommage résultant d'un virus transmis.

This e-mail and the documents attached are confidential and intended solely= for the addressee; it may also be privileged. If you receive this e-mail i= n error, please notify the sender immediately and destroy it. As its integr= ity cannot be secured on the Internet, the Worldline liability cannot be triggered for the message content. Altho= ugh the sender endeavours to maintain a computer virus-free network, the se= nder does not warrant that this transmission is virus-free and will not be = liable for any damages resulting from any virus transmitted.
 --_000_3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7DFRVDX103fr01a_-- --===============7730357797812603162== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============7730357797812603162==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: space_left_action syslog Date: Tue, 23 Feb 2016 11:25:55 -0500 Message-ID: <1549799.6vBbhpqkCg@x2> References: <3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7D@FRVDX103.fr01.awl.atosorigin.net> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3D2AB1326AB2974190FCE3F69401F790DB1EBF0C7D@FRVDX103.fr01.awl.atosorigin.net> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com Cc: Maupertuis Philippe List-Id: linux-audit@redhat.com On Tuesday, February 23, 2016 11:54:21 AM Maupertuis Philippe wrote: > The man page reads space_left_action : syslog means that it will issue a > warning to syslog. Please tell me where can I find an example of such a > message to look for it in the syslog ? https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L515 > Would the message be different for admin_space_left_action and > disk_full_action ? Yes for admin_space_left and disk full is here: https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L571 I suppose a distinction could be made between space_left and admin_space_left messages, but if you get either it needs attention right away. > When audispd is configured to send audit events to syslog would these > messages follow the same path. Auditd sends them to syslog directly. Because these are not events, audispd will never see them. -Steve > I would like to be able to separate these messages for an easy notice should > something go wrong.