From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bond Masuda Subject: Re: audit log still getting rotated even with max_log_file_action = ignore? Date: Fri, 6 Nov 2015 10:07:24 -0800 Message-ID: <563CEC5C.5010301@jlbond.com> References: <5637D841.3090501@jlbond.com> <2015477.b7QVr7lf9X@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <2015477.b7QVr7lf9X@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb , linux-audit@redhat.com List-Id: linux-audit@redhat.com On 11/02/2015 03:32 PM, Steve Grubb wrote: > I took a quick look at the code. I can't see how this is happening > unless auditd is receiving a SIGUSR1 signal. You might want to put > some syslog calls in to auditd-event.c log when auditd gets told to > rotate so that it can be correlated to other system activities. -Steve Hi Steve, The cron script i mention below does use "service auditd rotate", which does send a SIGUSR1. But these rotations are happening outside the time frame when that cron job runs. Additionally, they seem to rotate around when the log file reaches about 90MB. It almost seems like there's some default behavior? I was wondering if maybe my syntax in the config file was wrong and auditd was ignoring my setting and just using defaults? Bond >> I have a cron job in /etc/cron.daily/auditd that I use to rotate + >> compress the audit logs, but this is not what is causing the audit log >> rotation. >> >> Is there another setting I must set in order for it to not automatically >> rotate the audit log? How do I achieve the desired effect, where the >> audit log is only rotated when my cron script runs?