Re: auditd.cron

[Ed Christiansen MS <edwardc@ll.mit.edu>]

[-- Attachment #1.1: Type: text/plain, Size: 2235 bytes --]

So, if I read this right, to implement an auditd log rotation that is 
based on time one would:

1. set num_logs to 0 in auditd.conf

2. send SIGUSR1 to auditd based on your log rotation schedule.

Are there any other nuances I need to take into consideration?

On 3/22/2017 5:48 PM, Steve Grubb wrote:
> On Wednesday, March 22, 2017 5:19:11 PM EDT warron.french wrote:
>> So, I needed a feature over 8 months ago, nobody could provide one for the
>> following:
>>        Rolling log files either when they hit a certain size or the day
>> changed over at midnight.
>>
>> I know that I could have rolled the files at a specific size, by using the
>> *max_log_file* attribute as identified in the */etc/audit/auditd.conf*, but
>> there was no "builtin" for managing auto rotation at the start of a new day
>> (0000 hrs).
>>
>> It looks like there is a file called */usr/share/doc/auditd-<**version>*
>> */auditd.cron*
>>
>> *.*
>> To me*, *this file is new; considering I needed it 8 months ago.
>
> Its over 9 years old.
>
>> *Anyway, how is this file implemented?
>
> https://github.com/linux-audit/audit-userspace/blob/master/init.d/auditd.cron
>
> Its a shell script that end up sending SIGUSR1 to auditd. That causes auditd
> to rotate the files. But you would also configure auditd to not rotate files by
> setting num_logs to 0 in auditd.conf.
>
>> * Simply move it to a directory with permissions to execute; ensure it is
>> executable and then simply set up a cronjob to execute it at whatever time
>> of day that I wish?
>
> Yes. You can also extend the script by sleeping a couple seconds for the
> rotation and then rename the file and/or compress it and/or move it to another
> directory or partition. Whatever you want to do.
>
>> *Finally, if I have '-e 2' as the last control in the audit.rules file;
>> will the auditd.cron which executes as service auditd rotate still function
>> properly?*
>
> The -e 2 makes the rules immutable. Sending SIGUSR1 to the audit daemon just
> rotates the files. So, it has no bearing on the matter.
>
> -Steve
>
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit
>


[-- Attachment #1.2: S/MIME Cryptographic Signature --]
[-- Type: application/pkcs7-signature, Size: 4680 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]