From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bond Masuda Subject: Re: audit log still getting rotated even with max_log_file_action = ignore? Date: Sat, 7 Nov 2015 22:05:15 -0800 Message-ID: <563EE61B.2070605@jlbond.com> References: <5637D841.3090501@jlbond.com> <2015477.b7QVr7lf9X@x2> <563CEC5C.5010301@jlbond.com> <37102497.kx1YEe0YIN@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <37102497.kx1YEe0YIN@x2> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com On 11/06/2015 11:12 AM, Steve Grubb wrote: > On Friday, November 06, 2015 10:07:24 AM Bond Masuda wrote: >> On 11/02/2015 03:32 PM, Steve Grubb wrote: >>> I took a quick look at the code. I can't see how this is happening >>> unless auditd is receiving a SIGUSR1 signal. You might want to put >>> some syslog calls in to auditd-event.c log when auditd gets told to >>> rotate so that it can be correlated to other system activities. -Steve >> Hi Steve, >> >> The cron script i mention below does use "service auditd rotate", which >> does send a SIGUSR1. But these rotations are happening outside the time >> frame when that cron job runs. > Can you find any other cron job running around that time? > I'm still trying to hunt this down; haven't found anything thus far, but its possible I could have missed something. >> Additionally, they seem to rotate around when the log file reaches about >> 90MB. It almost seems like there's some default behavior? > The settings to note in your email are these: > > num_logs = 5 > max_log_file = 6 > max_log_file_action = ignore > admin_space_left = 50 > admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log > > This means you would have 6 log files that 5 MB each. However, the max_log_file > action says ignore. > > >> I was wondering if maybe my syntax in the config file was wrong and auditd was >> ignoring my setting and just using defaults? > It might be that you are hitting the admin_space_left_action which runs > remove_oldest_audit_log. That is my only guess. Does the math work out for > partition size - size of all logs being approximayely 50MB? If so, this is > your problem and you might need a bigger partition. I don't think that's the case: # df -h /var/log/audit/ Filesystem Size Used Avail Use% Mounted on /dev/mapper/vg_system-lv_audit 1014M 413M 602M 41% /audit > But based on a quick review of the man page, you might set num_logs = 0. That > is supposed to disable rotating as long as max_log_size_action != rotate. You > have ignore, so that should work if you don't have the problem noted above. > > -Steve > Ok, will try this and see if that unexpected rotation goes away. Thanks, Bond