1

Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config?

local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = root
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 100
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = keep_logs
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port =
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no

1 Answer 1

3

auditd cannot compress its own logs, you need to set up logrotate for that. For more info please check:

https://bgstack15.wordpress.com/2018/02/13/logrotate-audit-log-selinux-cron-and-ansible/

or https://www.stigviewer.com/stig/vmware_vrealize_operations_manager_6.x_sles/2018-10-11/finding/V-88747

Both are slightly outdated but you can trivially replace service restart auditd with systemctl restart auditd


Changes required for auditd.conf (by default it rotates files on its own which is not what we're looking for):

max_log_file             =  0
max_log_file_action      =  ignore

An example logrotate file, e.g. /etc/logrotate.d/audit

/var/log/audit/*.log {
        weekly
        missingok
        compress
        #copytruncate
        rotate 30
        minsize 100k
        maxsize 200M
        postrotate
                touch /var/log/audit/audit.log ||:
                chmod 0600 /var/log/audit/audit.log ||:
                service auditd restart
        endscript
}
0

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .