Logrotate and Audit Log Rotation

Logrotate and Audit Log Rotation

[Paul Whitney]

[-- Attachment #1.1: Type: text/plain, Size: 847 bytes --]

On RHEL 6 I am able to use the logrotate facility and compress logs using bzip2. However, when I try to use a similar method on RHEL 5, the auditd service fails to restart after the logrotate service rotates and compresses the rotated log file.

I found a post by Steve Grubb posted on 29 JUN 2011:
  
"Logrotate should not directly rotate the audit logs. I don't supply a logrotate 
configuration, but if I did it would call service auditd rotate so that auditd performs
the action. The audit daemon has to fulfill certain service guarantees that logrotate
does not care about. For example, if the audit disk partition gets full, auditd can
take the system down. Logrotate never will. So, you have to let auditd do its own
thing or you will have some issues."

Is this still the case? 

Paul M. Whitney
paul.whitney@icloud.com



[-- Attachment #1.2.1: Type: text/html, Size: 1241 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: Logrotate and Audit Log Rotation

[Steve Grubb]

On Wednesday, November 14, 2012 12:52:31 PM Paul Whitney wrote:
> On RHEL 6 I am able to use the logrotate facility and compress logs using
> bzip2. However, when I try to use a similar method on RHEL 5, the auditd
> service fails to restart after the logrotate service rotates and compresses
> the rotated log file.
> 
> I found a post by Steve Grubb posted on 29 JUN 2011:
>   
> "Logrotate should not directly rotate the audit logs. I don't supply a
> logrotate  configuration, but if I did it would call service auditd rotate
> so that auditd performs the action. The audit daemon has to fulfill certain
> service guarantees that logrotate does not care about. For example, if the
> audit disk partition gets full, auditd can take the system down. Logrotate
> never will. So, you have to let auditd do its own thing or you will have
> some issues."
> 
> Is this still the case? 

Yes, it will always be the case. Logrotate does not understand the security 
requirements imposed by common criteria. You can either rotate on a cron job 
(an example script is shipped) or write a logrotate script that sends SIGUSR1 
to auditd.

-Steve