Re: rotating audit logs

[Bill Tangren <bjt@aa.usno.navy.mil>]

Steve Grubb wrote:
> On Tuesday 13 February 2007 10:31, Bill Tangren wrote:
>> Is is possible to have the auditd daemon rotate the logs according to time,
>> rather than size?
> 
> There is a log rotation script suitable for cron usage in the audit package. 
> You just simply need to add it to your cron setup.

OK, I've found the auditd.cron file. How do I prevent auditd from rotating by 
size? Set the maximum size too high to be reached in a day?

> 
>> If auditd cannot do this, is it possible to turn off log rotating and let
>> the logrotate daemon do it?
> 
> You could do that too, but you'll have to teach logrotate about the audit 
> logs.

I've taught logrotate about other logs, so I don't see that as a problem. How to 
tell auditd not to rotate, though, that I DON'T know how to do.


> 
> -Steve
>