Trusted System Audit File Administration

[Richard Mertz]

What do you guys do for "automatically" administering the Audit files generated in trusted system auditing? How do you "remove them". I just started using trusted system audit, I backup the previous audit file and empty it. I get messages that the system can not switch to a new audit file even though the old one is now empty.

[Stefan Farrelly]

run runacct and monacct commands regularly to cleanup the auditing logs. see the manpages on them for options.

[Richard Mertz]

Stefan:

Those seem to be exclusively for accounting/charge back reporting. In a quick read, I didn't see anything about manipulating system audit files as created by audit in trusted systems. What am I missing?

Richard

[Tom Danzig · Accepted solution]

I copy the primary audit file to a tape, zero out the primary, and the run audsys to switch logging back to the primary. Do a man on audsys for the necessary switches to do so.

[Stefan Farrelly]

Those commands do a bit of trimming but I guess your talking about the large files in /.secure/etc audfile1 and 2 ?
What does your /.secure/etc/audnames file looklike, this controls the audit size and switching. Ours looks like this;
/.secure/etc/audfile2,20000
/.secure/etc/audfile1,20000
So our audit files will cycle around at 20Mb.
You can edit this file then stop and restart auditing (/sbin/init.d/auditing stop/start)