audit-0.6.7 released

Steve Grubb sgrubb at redhat.com
Thu Mar 10 18:29:53 UTC 2005


On Thursday 10 March 2005 13:22, Mounir Bsaibes wrote:
> Can you please tell us how this option works with the xxx_space_left
> options.

They are separate checks. One check is for the size of the file, the other 
check is for the amount of space left. They do not interfere with each other.

> What happens when the last audit.log.x is full do you start on audit.log
> again.

I always write to whatever the name was given by the admin. I follow the same 
algorithm as logrotate so that its familiar. 

Log rotation is critical for the casual user so that they can set aside a 
certain amount of diskspace and know audit isn't going to fill their drive.

-Steve Grubb




More information about the Linux-audit mailing list