audit file switch

[Lev Assinovsky]

Hi everybody!

Does anybody know what does audit do if even
"backup" file is full?
Thanks.

[Joseph Loo]

hi,

not quite sure i understand. audit has only "current" and "next" audit file set. as soon as "current" file has reach its stated size, "next" file will take over and grow past the stated size till u have stop auditing, i.e. audsys -f, and either migrate the 2 files to another location or delete them.

hope i answer your question.

regards.

[Sridhar Bhaskarla]

Hi,

It will not switch back to primary file. And it's really bad if auditing subsystem is not able to write to the log files. It will slow down the system.

Have a script in place that will check the sizes of the log files and switch them manually. 'audsys' without any options gives you how the files are used. Periodically archive the audit logs. Run cron every hour or so, set the current file to backup file using 'audsys -c ' command, archive the primary file, set it as the current file, archive the backupfile and set it as the next file.

Look at audsys command for usage information.

-Sri