From mboxrd@z Thu Jan  1 00:00:00 1970
From: "Wyatt, Curtis R" <Curtis.Wyatt@gd-ms.com>
Subject: RE: Audit log compression
Date: Thu, 28 Jun 2018 16:20:54 +0000
Message-ID: <fcacbbd482cc49098d1d9cedeb1a12b4@AZDC-MMB02.GD-MS.US>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
Received: from mx1.redhat.com (ext-mx04.extmail.prod.ext.phx2.redhat.com
	[10.5.110.28])
	by smtp.corp.redhat.com (Postfix) with ESMTPS id 4E65812A46
	for <linux-audit@redhat.com>; Thu, 28 Jun 2018 16:20:58 +0000 (UTC)
Received: from az25dmzegs02.gd-ms.com (az25dmzegs02.gd-ms.com [63.226.32.83])
	(using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256
	bits)) (No client certificate requested)
	by mx1.redhat.com (Postfix) with ESMTPS id 1C82D81111
	for <linux-audit@redhat.com>; Thu, 28 Jun 2018 16:20:57 +0000 (UTC)
Content-Language: en-US
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: "leamhall@gmail.com" <leamhall@gmail.com>
Cc: "linux-audit@redhat.com" <linux-audit@redhat.com>
List-Id: linux-audit@redhat.com

Our audit.rules file is governed by requirements, so we cannot reduce the amount of log data being generated.

>logrotate can be configured nicely. First big step is looking at
>what's going into the logs though. Are you logging at INFO level and
>do you need that. I've seen that be 90% or more of the log entries.