Regarding changing output time of audit log.

[Minoru Asano]

Hello,

I would like to know how to change the time which audit process output log.

[ENVIRONMENT]
RHEL 4 ES

[SITUATION]
At the customer site, audit log was generated at 3:00 am.
So he would like to change the time which audit process output log.

[QUESTION]
- How can I change the time which audit process output log ?
Could you tell me the configuration file ?

Thank you for advice.
Best Regards.
/Minoru.

[Stuart Browne]

I guess we'll just have to assume he's got a job cron'd at 3am.

Check in '/etc/crontab', '/etc/cron.d/*', '/etc/cron.daily/*' and the output of the command 'crontab -l'.

One of these places will have the audit log processing.

One of these will have the 2nd column saying '3'.

None of my RHEL4 boxes have any automated audit log reporting.. And it's not something I remember turning off.