On my CentOS linux machine, in my auditd.conf file, I have set my max_log_file_action=keep_logs.

However, in my /var/log/messages and /var/log/auditd.log, the following message appears multiple times a second which is filling up those log files quickly:

Audit daemon rotating log files with keep option 
Last known log disappeared (/data/log/audit.log.5) 
Next log to use will be /data/log/audit.log.5

Why are these messages appearing? Why so frequently? And how do I make them go away? they are incorrect nuisance messages (i.e., I'm not trying to rotate my auditd log)

Thanks in advance!


PS: I posted this over on Super User before I knew that this exchange was here. I found it as I continued to search for an answer... trying to solve this today! :)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.