audit log still getting rotated even with max_log_file_action = ignore?

audit log still getting rotated even with max_log_file_action = ignore?

[Bond Masuda]

I'm seeing my /var/log/audit/audit.log getting rotated (I find a audit.1
or audit.2, etc. file) even though I have max_log_file_action=ignore.
Here's the full auditd.conf:

log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = hostname
max_log_file = 6
max_log_file_action = ignore
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
disk_full_action = exec /usr/local/bin/remove_oldest_audit_log
disk_error_action = SUSPEND
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd

what am I missing?

I have a cron job in /etc/cron.daily/auditd that I use to rotate +
compress the audit logs, but this is not what is causing the audit log
rotation.

Is there another setting I must set in order for it to not automatically
rotate the audit log? How do I achieve the desired effect, where the
audit log is only rotated when my cron script runs?

Thanks,
Bond

Re: audit log still getting rotated even with max_log_file_action = ignore?

[Steve Grubb]

On Monday, November 02, 2015 01:40:17 PM Bond Masuda wrote:
> I'm seeing my /var/log/audit/audit.log getting rotated (I find a audit.1
> or audit.2, etc. file) even though I have max_log_file_action=ignore.
> Here's the full auditd.conf:
> 
> log_file = /var/log/audit/audit.log
> log_format = RAW
> log_group = root
> priority_boost = 4
> flush = INCREMENTAL
> freq = 20
> num_logs = 5
> disp_qos = lossy
> dispatcher = /sbin/audispd
> name_format = hostname
> max_log_file = 6
> max_log_file_action = ignore
> space_left = 75
> space_left_action = email
> action_mail_acct = root
> admin_space_left = 50
> admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
> disk_full_action = exec /usr/local/bin/remove_oldest_audit_log
> disk_error_action = SUSPEND
> tcp_listen_queue = 5
> tcp_max_per_addr = 1
> tcp_client_max_idle = 0
> enable_krb5 = no
> krb5_principal = auditd
> 
> what am I missing?

I took a quick look at the code. I can't see how this is happening unless 
auditd is receiving a SIGUSR1 signal.

You might want to put some syslog calls in to auditd-event.c log when auditd 
gets told to rotate so that it can be correlated to other system activities.

-Steve
 

> I have a cron job in /etc/cron.daily/auditd that I use to rotate +
> compress the audit logs, but this is not what is causing the audit log
> rotation.
> 
> Is there another setting I must set in order for it to not automatically
> rotate the audit log? How do I achieve the desired effect, where the
> audit log is only rotated when my cron script runs?

Re: audit log still getting rotated even with max_log_file_action = ignore?

[Bond Masuda]

On 11/02/2015 03:32 PM, Steve Grubb wrote:
> I took a quick look at the code. I can't see how this is happening
> unless auditd is receiving a SIGUSR1 signal. You might want to put
> some syslog calls in to auditd-event.c log when auditd gets told to
> rotate so that it can be correlated to other system activities. -Steve 

Hi Steve,

The cron script i mention below does use "service auditd rotate", which
does send a SIGUSR1. But these rotations are happening outside the time
frame when that cron job runs. Additionally, they seem to rotate around
when the log file reaches about 90MB. It almost seems like there's some
default behavior? I was wondering if maybe my syntax in the config file
was wrong and auditd was ignoring my setting and just using defaults?

Bond

>> I have a cron job in /etc/cron.daily/auditd that I use to rotate +
>> compress the audit logs, but this is not what is causing the audit log
>> rotation.
>>
>> Is there another setting I must set in order for it to not automatically
>> rotate the audit log? How do I achieve the desired effect, where the
>> audit log is only rotated when my cron script runs?

Re: audit log still getting rotated even with max_log_file_action = ignore?

[Steve Grubb]

On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote:
> On 11/02/2015 03:32 PM, Steve Grubb wrote:
> > I took a quick look at the code. I can't see how this is happening
> > unless auditd is receiving a SIGUSR1 signal. You might want to put
> > some syslog calls in to auditd-event.c log when auditd gets told to
> > rotate so that it can be correlated to other system activities. -Steve
> 
> Hi Steve,
> 
> The cron script i mention below does use "service auditd rotate", which
> does send a SIGUSR1. But these rotations are happening outside the time
> frame when that cron job runs.

Can you find any other cron job running around that time?


> Additionally, they seem to rotate around when the log file reaches about
> 90MB. It almost seems like there's some default behavior?

The settings to note in your email are these:

num_logs = 5
max_log_file = 6
max_log_file_action = ignore
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log

This means you would have 6 log files that 5 MB each. However, the max_log_file 
action says ignore.


> I was wondering if maybe my syntax in the config file was wrong and auditd was
> ignoring my setting and just using defaults?

It might be that you are hitting the admin_space_left_action which runs 
remove_oldest_audit_log. That is my only guess. Does the math work out for 
partition size - size of all logs being approximayely  50MB? If so, this is 
your problem and you might need a bigger partition.

But based on a quick review of the man page, you might set num_logs = 0. That 
is supposed to disable rotating as long as max_log_size_action != rotate. You 
have ignore, so that should work if you don't have the problem noted above.

-Steve


> >> I have a cron job in /etc/cron.daily/auditd that I use to rotate +
> >> compress the audit logs, but this is not what is causing the audit log
> >> rotation.
> >> 
> >> Is there another setting I must set in order for it to not automatically
> >> rotate the audit log? How do I achieve the desired effect, where the
> >> audit log is only rotated when my cron script runs?

Re: audit log still getting rotated even with max_log_file_action = ignore?

[Bond Masuda]

On 11/06/2015 11:12 AM, Steve Grubb wrote:
> On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote:
>> On 11/02/2015 03:32 PM, Steve Grubb wrote:
>>> I took a quick look at the code. I can't see how this is happening
>>> unless auditd is receiving a SIGUSR1 signal. You might want to put
>>> some syslog calls in to auditd-event.c log when auditd gets told to
>>> rotate so that it can be correlated to other system activities. -Steve
>> Hi Steve,
>>
>> The cron script i mention below does use "service auditd rotate", which
>> does send a SIGUSR1. But these rotations are happening outside the time
>> frame when that cron job runs.
> Can you find any other cron job running around that time?
>
I'm still trying to hunt this down; haven't found anything thus far, but
its possible I could have missed something.
>> Additionally, they seem to rotate around when the log file reaches about
>> 90MB. It almost seems like there's some default behavior?
> The settings to note in your email are these:
>
> num_logs = 5
> max_log_file = 6
> max_log_file_action = ignore
> admin_space_left = 50
> admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
>
> This means you would have 6 log files that 5 MB each. However, the max_log_file 
> action says ignore.
>
>
>> I was wondering if maybe my syntax in the config file was wrong and auditd was
>> ignoring my setting and just using defaults?
> It might be that you are hitting the admin_space_left_action which runs 
> remove_oldest_audit_log. That is my only guess. Does the math work out for 
> partition size - size of all logs being approximayely  50MB? If so, this is 
> your problem and you might need a bigger partition.
I don't think that's the case:

# df -h /var/log/audit/
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_system-lv_audit
                     1014M  413M  602M  41% /audit

> But based on a quick review of the man page, you might set num_logs = 0. That 
> is supposed to disable rotating as long as max_log_size_action != rotate. You 
> have ignore, so that should work if you don't have the problem noted above.
>
> -Steve
>
Ok, will try this and see if that unexpected rotation goes away.

Thanks,
Bond