space_left_action syslog
Steve Grubb
sgrubb at redhat.com
Tue Feb 23 16:25:55 UTC 2016
On Tuesday, February 23, 2016 11:54:21 AM Maupertuis Philippe wrote:
> The man page reads space_left_action : syslog means that it will issue a
> warning to syslog. Please tell me where can I find an example of such a
> message to look for it in the syslog ?
https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L515
> Would the message be different for admin_space_left_action and
> disk_full_action ?
Yes for admin_space_left and disk full is here:
https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L571
I suppose a distinction could be made between space_left and
admin_space_left messages, but if you get either it needs attention right
away.
> When audispd is configured to send audit events to syslog would these
> messages follow the same path.
Auditd sends them to syslog directly. Because these are not events, audispd
will never see them.
-Steve
> I would like to be able to separate these messages for an easy notice should
> something go wrong.
More information about the Linux-audit
mailing list