Trusted Audit Log

[Randy Gelineau]

When setting the log parameters on a trusted system...how large can the audit file be?

In sam the file cannot be set to a very large value. One command line (audsys) one could set the parameter for size to just about anything. However, not all sizes seem to work.

Is there a size limit to the audit file?

[Steven E. Protter]

You set the limit. You set the location.

I'm attachng a script that will be a good example.

SEP

[Muthukumar_5]

audit file informations can be retrieved using audsys or /etc/rc.config.d/auditing file.

audsys configuration details will be forgot after system reboot. Default one is at /etc/rc.config.d/auditing file

Audit file size depends upon the switch over size PRI_SWITCH parameter on auditing file or -s cafs option on audsys

auditing file is as like any normal file can be used to store contents. It is limit as like normal file. To make default setting about auditing use auditing file for that.

To get notification messages about audit log overflow use audmon call for this.

Regards
Muthu

[Randy Gelineau]

We are having problems getting the audit file to be a large size (99999k). The file does not fill but trusted mode doesn't seem to like it after a short time.

[Muthukumar_5]

It is good to use the secondary audit file after some limit of storage on primary file.

Or try to use logrotate logic(s) here to trim your logfile(s) everyday status to keep your audit file as healthy one.

Put the script in cron to automate that.

Or change the audsys operation on everyday as,


audsys -n -c -s -x -z

Move the file to your backup (with compression too)

Automate this with script.

NOTE: audsys - can not be effective if you reboot your system. You have to use auditing file

_muthu_