On my CentOS linux machine, in my auditd.conf file, I have set my max_log_file_action=keep_logs.
However, in my /var/log/messages and /var/log/auditd.log, the following message appears multiple times a second which is filling up those log files quickly:
Audit daemon rotating log files with keep option Last known log disappeared (/data/log/audit.log.5) Next log to use will be /data/log/audit.log.5
Why are these messages appearing? Why so frequently? And how do I make them go away? they are incorrect nuisance messages (i.e., I'm not trying to rotate my auditd log)
Thanks in advance!
PS: I posted this over on Super User before I knew that this exchange was here. I found it as I continued to search for an answer... trying to solve this today! :)