0

We have an use case that we need to compress a logfile when it is rotated.

More specifically we have the auditd audit trail that is rotated based on size...

So when the size of the logfile reaches 100M it will rotate and the following is added to /var/log/messages:

Audit daemon rotating log files with keep option

I would like, when this line is logged, that a script is executed that would compress the file audit.log.1 that has been created. I thought omprog to be the best way to do this unless there is something better.

the documentation on omprog is not very clear.. is what I want possible with rsyslog or another type of daemon who monitors the filesystem and upon the presence of a file it will trigger a compress script?

Improve this question
2
  • Configure logrotate to rotate your audit logs instead of auditd itself. It can compress logs, and signal auditd that the file has changed. It can even run an arbitrary program afterwards.
    – meuh
    Sep 18, 2019 at 16:17
  • no that is a no go.. it causes buffer errors like this: auditd[27134]: Error receiving audit netlink packet (No buffer space available) logrotate is not an option for me unfortunately. I am checking into python pyinotify that seems to do the trick. the recommended way to rotate auditd.log are by the auditd daemon itself. we had logrotate in place but too many events where lost everytime the log rotated with letting auditd itself to the rotation we doo not lose events. also increasing the buffer in audit.rules doesn't help either.. we put it very high. without success.
    – zn553
    Sep 18, 2019 at 16:31

1 Answer 1

Reset to default
0

To match the message and run a program, create a file such as /etc/rsyslog.d/99-myaudit.conf with the contents:

module(load="omprog")
if $msg startswith ' Audit daemon rotating log files' then action(type="omprog" binary="/bin/myprog")

and restart rsyslogd. I've included a space at the start of the message string, as this will probably be there. If you prefer you can use $msg contains 'Audit daemon rotating' to do a looser match.

The executable program or script /bin/myprog will run when there is a message match. It will be provided with matching messages on stdin. If the program exits, it will be restarted again the next time a message matches.

You can add a filename to collect output from the program whilst testing, eg action(type="omprog" binary="/bin/myprog" output="/tmp/mylog"). See omprog.

Improve this answer
2
  • thank you i did it and it does not do anything i see the entries of the log on /var/log/messages but i do not see the module being loaded or anything.
    – zn553
    Sep 19, 2019 at 10:05
  • I was too optimistic with the contents of $msg. It probably starts with a space, which I have added above. Or you can use contains instead of startswith to be sure of finding the string. Also, you can add to the action a parameter output="mylogfile" to get anything printed by your script, which might help with debugging.
    – meuh
    Sep 19, 2019 at 11:35

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.