Trying to customize auditd.cron


 
Thread Tools Search this Thread
Top Forums Shell Programming and Scripting Trying to customize auditd.cron
# 1  
Old 08-01-2014
Trying to customize auditd.cron

Hello all,
I'm trying to update auditd.cron to force rotate daily and gzip audit.log.1. I will probably then remove anything older that 3 months. The part I don't like about my script right now is the sleep command. It seems that the "/sbin/service auditd rotate" command must use a different shell because the audit.log.1 file is not always there by the time my move command would try to run. That is why I put in the sleep. I tried to capture the process id of the service command($!) and use wait, but that didn't work for me. Wondering if anyone has any ideas about this? FYI, this is on Centos 5.8.
Thanks,

Code:
#!/bin/bash
#
#auditd.cron
#
#-------------------------------------------------------------------
# This function is called whenever a program in this script
# returns a non-zero status.
#-------------------------------------------------------------------
doexit()
{
        echo '************************************************'
        echo ' FATAL ERROR !'
        echo '************************************************'
        exit 255
}
#
set -vax
#
curdttm=`date +%Y%m%d%H%M%S`
#
##########
# This script can be installed to get a daily log rotation
# based on a cron job.
##########
#
/sbin/service auditd rotate
#
EXITVALUE=$?
#
if [ $EXITVALUE != 0 ]; then
    /usr/bin/logger -t auditd "ALERT exited abnormally with [$EXITVALUE]"
    doexit
fi
#
# Wait for log to rotate
sleep 60
#
mv /var/log/audit/audit.log.1 /var/log/audit/audit.log.${curdttm}
#
#
if [ $? -ne 0 ]; then doexit ; fi
#
/bin/gzip -9 /var/log/audit/audit.log.${curdttm}
#
if [ $? -ne 0 ]; then doexit ; fi
#
exit 0

# 2  
Old 08-01-2014
You can delay the compression of the 1st file until the next invocation of the script.
Further you can do it with logrotate; create a /etc/logrotate.d/auditd like this:
Code:
/var/log/audit/audit.log {
    daily
    dateext
    rotate 91
    compress
    delaycompress # leaves the 1st file uncompressed
    postrotate
        kill -HUP `cat /var/run/auditd.pid 2> /dev/null` 2> /dev/null || true
        #maybe nicer: service auditd reload
    endscript
}


Last edited by MadeInGermany; 08-01-2014 at 05:14 PM.. Reason: typo
# 3  
Old 08-01-2014
Since you didn't put anything into the background, the value of $! is meaningless.

All service auditd rotate does is send it SIGUSR1 anyway, which takes hardly any time at all. auditd rotates its logs itself.

So, only auditd can tell you when it's done rotating its logs. Does it write a message saying so anywhere? Even if it's in the logs being rotated, you might be able to kludge it with tail -f...

[edit] Delaying its compression is a great idea. It should make the speed it rotates them more predictable.
Login or Register to Ask a Question

Previous Thread | Next Thread

10 More Discussions You Might Find Interesting

1. Solaris

Configuring 'auditd' service to not store the audit logs in /var partition

Hello all, I've configured 'audit' service to send the audit logs to a remote log server (by using syslog plugin), which is working fine. However, there is a problem. audit service also tries to write same information (but in binary format) in /var/audit path. So, Is there anyway to stop... (2 Replies)
Discussion started by: Anti_Evil
2 Replies

2. UNIX for Dummies Questions & Answers

Auditd (How to disable)

I'm running CentOS 5.x and want to disable this daemon as it's crashing my server daily! I didn't install that and don't know why it's started magically for some reason. Please enlighten me to the answer to this question, I've read the man pages on this and found something that stops it... (2 Replies)
Discussion started by: HiphopTech
2 Replies

3. Cybersecurity

Events done on the serial console does not get recorded via the auditd

the events done on the serial console does not get logged. I am using BSM audit. I have enabled all audit flags. Is there anything that im missing? Please help!! (2 Replies)
Discussion started by: chinchao
2 Replies

4. Shell Programming and Scripting

help me with customize script.

Hi forum members, I have customize command which is opening in one user and while I am try from my user it is not working and getting the message KSH not found. This command is used to open encrypted file ,this command take arguments file name and option ie plz find the below command. ... (1 Reply)
Discussion started by: sivaranga001
1 Replies

5. Red Hat

Auditd event cache

I'm writing an auditd plugin. In my testing, I enabled pam_tty_audit. After running test data through it, I notice that when logged in as root, the tty events are sent in real time, and not cached in the event queue. When running as a user, the events are only spit out by the dispatcher (and... (0 Replies)
Discussion started by: tahoekid
0 Replies

6. UNIX for Dummies Questions & Answers

Auditd problem

Hi, I have the following my logs: Nov 20 04:02:04 mail-07 kernel: audit: audit_backlog=326 > audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: audit_lost=4272 audit_rate_limit=0 audit_backlog_limit=320 Nov 20 04:02:04 mail-07 kernel: audit: backlog limit exceeded Nov 20... (0 Replies)
Discussion started by: mojoman
0 Replies

7. Linux

sending messages from auditd logs to syslog server

I have the auditd running and I need to send the audit logs to a remote syslog server. Anyideas on how to do that? (1 Reply)
Discussion started by: jmathenge
1 Replies

8. Solaris

customize dtlogin

Hello out there! I'm using dtlogin with my SunRay 2 and SunRay Server Software 4.0. Now I want to customize the look an funcionality of the dtlogin. e.g. disable the Options - Button or change the Helptext. Can anybody give me a hint where to find a good manual for dtlogin or which files I... (2 Replies)
Discussion started by: Blang
2 Replies

9. Red Hat

auditd

Has anyone used, or set up auditd? I want to use it to audit critical system files. Will this be hard, how would I start setting this up? :eek: (2 Replies)
Discussion started by: syndex
2 Replies

10. UNIX for Dummies Questions & Answers

how to disable auditd daemon

I want to disable the auditd daemon on my unix server. Running this daemon on the server causes to system to crash afer every two month. Could any one let me know step by step how to disable it and is there any implication of doing it? (2 Replies)
Discussion started by: skumar11
2 Replies
Login or Register to Ask a Question