Setting audit logs as different group ID

Setting audit logs as different group ID

[Ameel Kamboh]

[-- Attachment #1.1: Type: text/plain, Size: 794 bytes --]

Is there a way to have the audit log files be a member of a different
group (other then root)
Currently I am seeing this:
-rw-r----- 1 root root       837716 Aug  3 10:06 audit.log
-r--r----- 1 root root     52428840 Aug  3 08:24 audit.log.1
-r--r----- 1 root root      5242936 Jul 24 10:56 audit.log.2
-r--r----- 1 root ntsecadm  5242911 Jul 23 15:33 audit.log.3

I had originally set the group for /var/log/audit/audit.log to
root:ntsecadm during post install or RH5
After the audit logs rotate the new files take on root:root ownership, I
would like them to also be root:ntsecadm

Can this be set in audit.conf?
Ameel Kamboh
SIP Core Network and Security 
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh@techtrial.com
email: akamboh@nortel.com




[-- Attachment #1.2: Type: text/html, Size: 2456 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Setting audit logs as different group ID

[Steve Grubb]

On Friday 03 August 2007 11:08:28 Ameel Kamboh wrote:
> Is there a way to have the audit log files be a member of a different
> group (other then root)

Not today.

> Can this be set in audit.conf?

I can add this to the TODO list and get to it in a future release.

-Steve