Rotation of audit logs
Steve Grubb
sgrubb at redhat.com
Thu May 19 12:45:05 UTC 2005
On Wednesday 18 May 2005 19:24, Kris Wilson wrote:
> Can you explain the rotation order to me?
Suppose we have 3 logs and need to rotate. log.2 is deleted, .1 becomes .2,
log becomes .1, and a new log is opened. Analysis from oldest to newest is
done from .2 -> log. Individual log files are appended to - so more recent
stuff is at the end and older stuff at the beginning.
-Steve
More information about the Linux-audit
mailing list