Re: Audit rotate vs log rotate questions

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday, June 29, 2011 07:10:44 PM Dole, Patrick A. wrote:
> I was hoping you could provide some help with audit rotation vs. logrotate
> 
> I'm running REL 5 SElinux
> In my daily.con I have 2 cron jobs that I believe should manage the
> 'audit.log' file; audit.cron and logrotate
> 
> My audit.cron includes:
>         service auditd rotate
> 
> Does this imply that the log always gets rotated, or is this based on other
> conditional checks? 

This issues a signal to auditd and it immediately rotates without any checks. If it 
had rotated 1 second before you issue the rotate command because of file size checks, 
it would even rotate the empty audit log.


> There are no other parameters in the audit.cron, so I
> don't see where 'max_log_size_action' or  'max_log_file_action' are
> checked. Here is my auditd.conf

The audit daemon will rotate based on size in addition to the cron job unless you set 
max_log_size_action to ignore. This will make 1 big log file. If you want it to rotate, 
set the max_log_size appropriately and choose another setting.

 
> Also, I've read that cron doesn't like files with a period (.) in the name
> - is this an issue with REL 5?

Offhand I have never heard such an issue, but I would think there should be something 
in the /var/log/messages file if it didn't like it.

 
> My basic questions is wouldn't the audit.cron, if it actually rotates the
> log, preclude the logrotate from properly capturing the right log files
> monthly? 

Logrotate should not directly rotate the audit logs. I don't supply a logrotate 
configuration, but if I did it would call service auditd rotate so that auditd performs 
the action. The audit daemon has to fulfill certain service guarantees that logrotate 
does not care about. For example, if the audit disk partition gets full, auditd can 
take the system down. Logrotate never will. So, you have to let auditd do its own 
thing or you will have some issues.


> Also, if I wanted to ensure no audit.log data ever gets deleted,
> could I simply increase the 'rotate 12' statement to something like
> 'rotate 60' to keep 5 years of data (provided the disk doesn't get full).

No, set the max_log_file_action to ignore. Note that this is a different issue than what 
I described as making 1 big file.


> FYI, there is another utility that archives  the log files and gives the
> user the option to delete files after they are archived.

There are probably people on this list that can tell you what they do. I would suspect 
they have a custom cron job.

-Steve