event auditing - who's got the "grooming" scripts?

[B. Chapman]

Greetings!

Since I've just turned Event Auditing on - (pet peeve - gotta love the default of the root filesystem to store the audfiles! ;-) - anyhoo, I've noticed that after the 1st switch, if you don't define an auxiliary file, the primary just keeps growing and growing and... Well, you get the idea.

I was wondering if anyone has some nifty scripts to automate/facilitate the log switching, grooming, re-auxiliary-ing, etc...

As always, thanks in advance!

Later,
Ben Chapman
bchapman@telcordia.com

An

[harry d brown jr]

Check this link out:

http://kubarb.phsx.ukans.edu/~tbird/log-analysis.html


live free or die
harry

[harry d brown jr]

Also:

http://www.ussrback.com/UNIX/unixIDS.htm

[Craig Rants · Accepted solution]

Ben,
To avoid your pet peeve, link the .secure directory to a directory in /var. Thats what var is for and if you ever have to untrust your system your auditing logs won't be removed.