topic Re: Rotating audit logs in Operating System - Linux

Rotating audit logs

Danesh Qureshi — Mon, 02 Jul 2007 10:35:18 GMT

Is it possible to have the auditd daemon rotate the logs according to time,
rather than size?

If auditd cannot do this, is it possible to turn off log rotating and let
the logrotate daemon do it?

Re: Rotating audit logs

Steven E. Protter — Mon, 02 Jul 2007 10:42:22 GMT

Shalom,

Logrotate can contain custom code to shut a daemon down to permit rotation.

Take a look at the configuration of the httpd log rotate daemon.

Or you can do a custom script to do the same thing.

Your choice.

SEP

Re: Rotating audit logs

skt_skt — Mon, 02 Jul 2007 20:05:57 GMT

i would recommaend to turn off the audit service.it is enabled by default on RHEL 3.0. But not available on AS 2.1 and AS 4.

It makes system hang if the /var file system reaches 80% usage which is controled by the default settings.No other way other than reboot as it stops accepting any system calls. "man audit" for more details.

Also it makes lot of files of /var/log/audit.d as bin.? and roll them to save.? as it grows up.The save files grows like save.1 and sav.2 etc..

Never do any operation(rm/mv)on recent files(bin.?) and which too cause the server hangs. Be carefull if the file system is near to 80% and you may be at a potential risk.

Re: Rotating audit logs

skt_skt — Mon, 02 Jul 2007 20:07:41 GMT

audit service has dependencies with other important services too. Try disabling it on a test box first..

Re: Rotating audit logs

Danesh Qureshi — Tue, 03 Jul 2007 04:36:21 GMT

The system is running RHEL AS3 update 4.

The system was not prompting me for a password. I decided to reboot the system. After rebooting the system I noticed the /var filesystem was 100% full. I looked around and found lots of save.? files in /var/log/audit.d. I deleted all save.? files and now /var is 17% full. I left the bin.? as they are.

You were right the system was hanging because /var 100% full.

Is there a way to rotate the save.? files based on age so that they /var filesystem does not become full and cause the system to hang?

If I turn off audit service will this present any problems in terms of securuty events and system alert.

Re: Rotating audit logs

skt_skt — Tue, 03 Jul 2007 17:05:28 GMT

we niether use the log files nor the audit service.There are lot of other log files or services built in Linux (a standard across all the versions) which can do our need.As i said this service is particular to RHEL AS 3.

This should notc cause any problem to other security events or monitoring.We have already implemented this