buffer space

[Steve Grubb]

On Monday 17 August 2009 10:49:55 am David Flatley wrote:
>  If I were to move all the rotated logs to another directory,
> say /home/logs. So instead of doing "ausearch -i" to capture all the
> information in the rotated logs in
> /var/log/audit directory. I would do "ausearch -i -f /home/logs" , correct?

Yes.

> Backlog is set to 12288 right now.

ok

>  The SECSCAN requires many -w (watches) and a fair amount of syscalls. I
> modified the syscalls to add your recommendation for using "arch=b32" and
> "arch=b64".

Are there any public references to this standard?


> Because I was getting errors restarting the auditd on some of their
> recommendations one of which was mount?

Yes, that is correct. Mount is syscall 165 on x86_64 and 21 on i386.


>  Another setting I believe was doing me in was the log size is 20 megs and
> I allow 8 rotated logs. But I had admin_disk_full set to 160 and the action
> was suspend.
> So this could have been tripping me up also.

If the partition was 320Mb or smaller, then yes that would be a problem. But I 
also think the fact that its being suspended is sent to syslog.


>   I would like to be able to do the audit log extractions (ausearch and
> aureport) when I get say 8 - 20 megs logs. I see I can do an exec on a
> script in max_log_file_action.
> So if I set the max_log_file to 160, I can then run a script to move the
> rotated logs and process them, thus not stopping auditd and keeping things
> working?

Yes, I think so. But if you are hooking max_log_file action, then you would 
need to send sigusr1 to ppid to get auditd to rotate the log and open another 
one. If you don't, auditd will still have an open descriptor to the file.

-Steve