Login or Register to Ask a Question and Join Our Community

Sponsored Content
Full Discussion: Trying to customize auditd.cron
Top Forums Shell Programming and Scripting Trying to customize auditd.cron Post 302911603 by MadeInGermany on Friday 1st of August 2014 04:06:03 PM
Old 08-01-2014
You can delay the compression of the 1st file until the next invocation of the script.
Further you can do it with logrotate; create a /etc/logrotate.d/auditd like this:
Code:
/var/log/audit/audit.log {
    daily
    dateext
    rotate 91
    compress
    delaycompress # leaves the 1st file uncompressed
    postrotate
        kill -HUP `cat /var/run/auditd.pid 2> /dev/null` 2> /dev/null || true
        #maybe nicer: service auditd reload
    endscript
}

Last edited by MadeInGermany; 08-01-2014 at 05:14 PM.. Reason: typo
 

10 More Discussions You Might Find Interesting

1. UNIX for Dummies Questions & Answers

how to disable auditd daemon

I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Discussion started by: skumar11
2 Replies

2. Red Hat

auditd

Has anyone used, or set up auditd? I want to use it to audit critical system files. Will this be hard, how would I start setting this up? :eek: (2 Replies)
Discussion started by: syndex
2 Replies

3. Solaris

customize dtlogin

Hello out there! I'm using dtlogin with my SunRay 2 and SunRay Server Software 4.0. Now I want to customize the look an funcionality of the dtlogin. e.g. disable the Options - Button or change the Helptext. Can anybody give me a hint where to find a good manual for dtlogin or which files I... (2 Replies)
Discussion started by: Blang
2 Replies

4. Linux

sending messages from auditd logs to syslog server

I have the auditd running and I need to send the audit logs to a remote syslog server. Anyideas on how to do that? (1 Reply)
Discussion started by: jmathenge
1 Replies

5. UNIX for Dummies Questions & Answers

Auditd problem

Hi, I have the following my logs: Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded Nov 20... (0 Replies)
Discussion started by: mojoman
0 Replies

6. Red Hat

Auditd event cache

I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit. After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue. When running as a user, the events are only spit out by the dispatcher (and... (0 Replies)
Discussion started by: tahoekid
0 Replies

7. Shell Programming and Scripting

help me with customize script.

Hi forum members, I have customize command which is opening in one user and while I am try from my user it is not working and getting the message KSH not found. This command is used to open encrypted file ,this command take arguments file name and option ie plz find the below command. ... (1 Reply)
Discussion started by: sivaranga001
1 Replies

8. Cybersecurity

Events done on the serial console does not get recorded via the auditd

the events done on the serial console does not get logged. I am using BSM audit. I have enabled all audit flags. Is there anything that im missing? Please help!! (2 Replies)
Discussion started by: chinchao
2 Replies

9. UNIX for Dummies Questions & Answers

Auditd (How to disable)

I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily! I didn't install that and don't know why it's started magically for some reason. Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Discussion started by: HiphopTech
2 Replies

10. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

LEARN ABOUT REDHAT

audit_data

audit_data(4)							   File Formats 						     audit_data(4)

NAME

       audit_data - current information on audit daemon

SYNOPSIS

       /etc/security/audit_data

DESCRIPTION

       The  audit_data file contains information about the audit daemon. The file contains the process ID of the audit daemon, and the pathname of
       the current audit log file. The format of the file is:

	      pid>:<pathname>

       Where pid is the process ID for the audit daemon, and pathname is the full pathname for the current audit log file.

EXAMPLES

       Example 1: A sample audit_data file.

       64:/etc/security/audit/server1/19930506081249.19930506230945.bongos

FILES

       /etc/security/audit_data

ATTRIBUTES

       See attributes(5) for descriptions of the following attributes:

       +-----------------------------+-----------------------------+
       |      ATTRIBUTE TYPE	     |	    ATTRIBUTE VALUE	   |
       +-----------------------------+-----------------------------+
       |Interface Stability	     |Obsolete			   |
       +-----------------------------+-----------------------------+

SEE ALSO

       audit(1M), auditd(1M), bsmconv(1M), audit(2), audit_control(4), audit.log(4)

NOTES

       The functionality described on this manual page is internal to audit(1M) and might not be supported in a future release.

       The auditd utility is the only supported mechanism to communicate with auditd(1M). The current audit log can be determined by examining the
       configured audit directories. See audit_control(4).

       The  functionality described on this manual page is available only if the Basic Security Module (BSM) has been enabled. See bsmconv(1M) for
       more information.

SunOS 5.10							    14 Nov 2002 						     audit_data(4)
All times are GMT -4. The time now is 08:23 PM.
Unix & Linux Forums Content Copyright 1993-2022. All Rights Reserved.
Privacy Policy