From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Audit rotate Date: Thu, 08 Jan 2015 12:23:35 -0500 Message-ID: <1763445.H1fdlcGX4z@x2> References: <1676603.MYLvDDvdka@scrapy.abaqis.com> <6261675.DUDNApPUjC@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: David Flatley Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday, January 08, 2015 12:17:40 PM David Flatley wrote: > I have "/sbin/service auditd rotate" in my scripts I use on my Red Hat > systems. But apparently on Suse it does not rotate the logs. When I run the > rotate command it comes back with what it can > do and rotate is not in there. Oh and it is auditd 1.8.0.30-1. What I'm trying to say is that if the init script does not support it, then all you need to do is send sigusr1 to auditd instead. Something like: kill -USR1 `pidof auditd` -Steve > From: Steve Grubb > To: David Flatley/Burlington/IBM@IBMUS, > Cc: linux-audit@redhat.com > Date: 01/08/2015 11:46 AM > Subject: Re: Audit rotate > > On Thursday, January 08, 2015 11:39:17 AM David Flatley wrote: > > Trying to setup Auditing on a Suse Server 11 SP3 with audit version > > > > 1.8.0.3. Apparently "audit rotate" is not available on this version of > > auditd? I know from past posts by Steve Grubb that logrotate does not > > work well rotating /var/log/audit/audit.log. So any thoughts on doing > > audit > > > logrotations? > > "service auditd rotate" is simply a convenience for sending SIGUSR1 to > auditd. > That is all you need to do to force rotation of the logs. > > -Steve