From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Ameel Kamboh" Subject: Setting audit logs as different group ID Date: Fri, 3 Aug 2007 10:08:28 -0500 Message-ID: <95470FF653FF324C8171194A81299CE01551F1D1@zrc2hxm2.corp.nortel.com> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1359473812==" Return-path: Received: from mx1.redhat.com (mx1.redhat.com [172.16.48.31]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id l73F8cLv008595 for ; Fri, 3 Aug 2007 11:08:38 -0400 Received: from zrtps0kn.nortel.com (zrtps0kn.nortel.com [47.140.192.55]) by mx1.redhat.com (8.13.1/8.13.1) with ESMTP id l73F8aDg003935 for ; Fri, 3 Aug 2007 11:08:36 -0400 Received: from zrc2hxm2.corp.nortel.com (zrc2hxm2.corp.nortel.com [47.103.123.73]) by zrtps0kn.nortel.com (Switch-2.2.6/Switch-2.2.0) with ESMTP id l73F8Tu04839 for ; Fri, 3 Aug 2007 15:08:29 GMT Content-class: urn:content-classes:message List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com This is a multi-part message in MIME format. --===============1359473812== Content-class: urn:content-classes:message Content-Type: multipart/alternative; boundary="----_=_NextPart_001_01C7D5E0.25CC1100" This is a multi-part message in MIME format. ------_=_NextPart_001_01C7D5E0.25CC1100 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Is there a way to have the audit log files be a member of a different group (other then root) Currently I am seeing this: -rw-r----- 1 root root 837716 Aug 3 10:06 audit.log -r--r----- 1 root root 52428840 Aug 3 08:24 audit.log.1 -r--r----- 1 root root 5242936 Jul 24 10:56 audit.log.2 -r--r----- 1 root ntsecadm 5242911 Jul 23 15:33 audit.log.3 I had originally set the group for /var/log/audit/audit.log to root:ntsecadm during post install or RH5 After the audit logs rotate the new files take on root:root ownership, I would like them to also be root:ntsecadm Can this be set in audit.conf? Ameel Kamboh SIP Core Network and Security=20 Phone: 972.685.4922 (esn 445-4922) Mobile: 978-590-2280 SIP: akamboh@techtrial.com email: akamboh@nortel.com ------_=_NextPart_001_01C7D5E0.25CC1100 Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable Setting audit logs as different group ID

Is there a way to have the audit log = files be a member of a different group (other then root)
Currently I am seeing this:
-rw-r----- 1 root = root       837716 Aug  3 10:06 = audit.log
-r--r----- 1 root = root     52428840 Aug  3 08:24 = audit.log.1
-r--r----- 1 root = root      5242936 Jul 24 10:56 = audit.log.2
-r--r----- 1 root ntsecadm  = 5242911 Jul 23 15:33 audit.log.3

I had originally set the group for = /var/log/audit/audit.log to root:ntsecadm during post install or = RH5
After the audit logs rotate the new = files take on root:root ownership, I would like them to also be = root:ntsecadm

Can this be set in audit.conf?
Ameel Kamboh
SIP Core Network and Security =
Phone: 972.685.4922 = (esn 445-4922)
Mobile: = 978-590-2280
SIP: = akamboh@techtrial.com
email: = akamboh@nortel.com



------_=_NextPart_001_01C7D5E0.25CC1100-- --===============1359473812== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1359473812==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Setting audit logs as different group ID Date: Fri, 3 Aug 2007 18:06:21 -0400 Message-ID: <200708031806.21776.sgrubb@redhat.com> References: <95470FF653FF324C8171194A81299CE01551F1D1@zrc2hxm2.corp.nortel.com> Mime-Version: 1.0 Content-Type: text/plain; charset="utf-8" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <95470FF653FF324C8171194A81299CE01551F1D1@zrc2hxm2.corp.nortel.com> Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Friday 03 August 2007 11:08:28 Ameel Kamboh wrote: > Is there a way to have the audit log files be a member of a different > group (other then root) Not today. > Can this be set in audit.conf? I can add this to the TODO list and get to it in a future release. -Steve