From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: space_left_action=exec only works once?
Date: Thu, 26 Jan 2017 07:22:10 +0100
Message-ID: <20170126072210.5630c661@ivy-bridge>
References: <07fd9f56-bc4c-b483-cdab-cca841ba0b4c@jlbond.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <07fd9f56-bc4c-b483-cdab-cca841ba0b4c@jlbond.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Bond Masuda <bond.masuda@jlbond.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

Hello,

On Wed, 25 Jan 2017 15:06:50 -0800
Bond Masuda <bond.masuda@jlbond.com> wrote:
> I configured space_left and space_left_action to run a script that 
> compresses and moves older audit log files from /var/log/audit. It 
> appears to work 1 time, and then doesn't work anymore until I kill
> the auditd daemon and start it again.
> 
> Is this expected and/or desired behavior? I didn't see anything in
> the man pages about this behavior. I was hoping to have my script run
> every time the space_left threshold is hit so as to not run out of
> logging disk space. Is there something I can do to accomplish this?

You may need to send SIGUSR2 to `pidof auditd` to reset the internal
counters. Let me know if that does not fix it.

-Steve