Re: audit log still getting rotated even with max_log_file_action = ignore?

[Bond Masuda <bond.masuda@jlbond.com>]

On 11/02/2015 03:32 PM, Steve Grubb wrote:
> I took a quick look at the code. I can't see how this is happening
> unless auditd is receiving a SIGUSR1 signal. You might want to put
> some syslog calls in to auditd-event.c log when auditd gets told to
> rotate so that it can be correlated to other system activities. -Steve 

Hi Steve,

The cron script i mention below does use "service auditd rotate", which
does send a SIGUSR1. But these rotations are happening outside the time
frame when that cron job runs. Additionally, they seem to rotate around
when the log file reaches about 90MB. It almost seems like there's some
default behavior? I was wondering if maybe my syntax in the config file
was wrong and auditd was ignoring my setting and just using defaults?

Bond

>> I have a cron job in /etc/cron.daily/auditd that I use to rotate +
>> compress the audit logs, but this is not what is causing the audit log
>> rotation.
>>
>> Is there another setting I must set in order for it to not automatically
>> rotate the audit log? How do I achieve the desired effect, where the
>> audit log is only rotated when my cron script runs?