space_left_action syslog

[Steve Grubb]

On Tuesday, February 23, 2016 11:54:21 AM Maupertuis Philippe wrote:
> The man page reads space_left_action : syslog means that it will issue a
> warning to syslog. Please tell me where can I find an example of such a
> message to look for it in the syslog ?

https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L515


> Would the message be different for admin_space_left_action and
> disk_full_action ? 

Yes for admin_space_left and disk full is here:
https://fedorahosted.org/audit/browser/trunk/src/auditd-event.c#L571

I suppose a distinction could be made between space_left and 
admin_space_left messages, but if you get either it needs attention right 
away.


> When audispd is configured to send audit events to syslog would these
> messages follow the same path.

Auditd sends them to syslog directly. Because these are not events, audispd 
will never see them.

-Steve

> I would like to be able to separate these messages for an easy notice should
> something go wrong.