audit log full

[Rashid Hamid]

/log filesystem full because of audit trail log growing rapidly.
The size of /log is 2gb

Is there a way to trim or to stop auditlog when reaching certain limit?

Thanks

[RAC_1]

What auidting?? hp-ux auditing?? Check acctresume and acctsuspend kernel tuables. these settings will decide, when auditing will stop on account of free epsace available.

[Muthukumar_5]

Do you mean auding system log(s). You can configure with /etc/rc.config.d/auditing. See man audsys page more.

--
Muthu

[Steven E. Protter]

Shalom,

A script is needed to move the logs out of there once in a while.

#!/usr/bin/ksh

audsys -f
mv /home/secure/aud* /backups
audsys -n -c /home/secure/audfile1 -s 10000 -x /home/secure/audfile2 -z 10000

Change this code as you need it to handle the change.

SEP

[Arunvijai_4]

Hello,

You can delete the unwanted log files, also, you can use logrotate,

http://hpux.connect.org.uk/hppd/hpux/Sysadmin/logrotate-2.5/

-Arun

[Muthukumar_5]

You can write a script to check file size of log file and trim simply as,

> logfile (to make file with 0 size)

or to stop

audisp -f

Automate with crontab to check every 5 seconds.

--
Muthu