Bug 325561

Summary: num_logs option is needed for keep_logs to work in /etc/auditd.conf
Product: Red Hat Enterprise Linux 4 Reporter: Calvin Smith <casmith>
Component: auditAssignee: Steve Grubb <sgrubb>
Status: CLOSED ERRATA QA Contact: Brian Brock <bbrock>
Severity: medium Docs Contact:
Priority: medium    
Version: 4.5CC: cward, ldolihal
Target Milestone: ---   
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: RHBA-2008-0731 Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2008-07-24 19:58:18 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Attachments:
Description Flags
auditd.conf file. none

Description Calvin Smith 2007-10-09 20:41:26 UTC 
Description of problem:
If num_logs is disabled in /etc/auditd.conf file and max_log_file_action is set
to keep_logs, when the log file grows beyond the size of max_log_file_action the
following error goes into the log file:

Oct  9 14:22:48 node73 auditd[10776]: Last known log disappeared
(/var/log/audit/audit.log.1)
Oct  9 14:22:48 node73 auditd[10776]: Next log to use will be
/var/log/audit/audit.log.1

roughly 30 times a second. Needless to say this fills up the logfile quickly. 

audit-1.0.15-3.EL4

attached is auditd.conf file.
Comment 1 Calvin Smith 2007-10-09 20:41:26 UTC 
Created attachment 221751 [details]
auditd.conf file.
Comment 2 Steve Grubb 2008-04-10 17:16:58 UTC 
Easy fix, scheduling for 4.7.
Comment 3 RHEL Program Management 2008-04-10 17:28:11 UTC 
This request was evaluated by Red Hat Product Management for inclusion in a Red
Hat Enterprise Linux maintenance release.  Product Management has requested
further review of this request by Red Hat Engineering, for potential
inclusion in a Red Hat Enterprise Linux Update release for currently deployed
products.  This request is not yet committed for inclusion in an Update
release.
Comment 5 Steve Grubb 2008-04-10 20:59:02 UTC 
audit-1.0.16-1 was built to solve this problem.
Comment 10 errata-xmlrpc 2008-07-24 19:58:18 UTC 
An advisory has been issued which should help the problem
described in this bug report. This report is therefore being
closed with a resolution of ERRATA. For more information
on therefore solution and/or where to find the updated files,
please follow the link below. You may reopen this bug report
if the solution does not work for you.

http://rhn.redhat.com/errata/RHBA-2008-0731.html
Comment 11 Ludek Dolihal 2010-01-29 10:05:12 UTC 
Test