auditd not compressing logs during rotation

Question

Audit is not compressing any logs. Perhaps this is a config issue. Could you perhaps tell me what's causing this in the below config?

local_events = yes
write_logs = yes
log_file = /var/log/audit/audit.log
log_group = root
log_format = RAW
flush = INCREMENTAL_ASYNC
freq = 50
max_log_file = 100
num_logs = 5
priority_boost = 4
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = NONE
##name = mydomain
max_log_file_action = keep_logs
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = SUSPEND
disk_full_action = SUSPEND
disk_error_action = SUSPEND
use_libwrap = yes
##tcp_listen_port =
tcp_listen_queue = 5
tcp_max_per_addr = 1
##tcp_client_ports = 1024-65535
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd
##krb5_key_file = /etc/audit/audit.key
distribute_network = no

Artem S. Tashkinov · Accepted Answer · 2020-11-16 16:48:38Z

auditd cannot compress its own logs, you need to set up logrotate for that. For more info please check:

https://bgstack15.wordpress.com/2018/02/13/logrotate-audit-log-selinux-cron-and-ansible/

or https://www.stigviewer.com/stig/vmware_vrealize_operations_manager_6.x_sles/2018-10-11/finding/V-88747

Both are slightly outdated but you can trivially replace service restart auditd with systemctl restart auditd

Changes required for auditd.conf (by default it rotates files on its own which is not what we're looking for):

max_log_file             =  0
max_log_file_action      =  ignore

An example logrotate file, e.g. /etc/logrotate.d/audit

/var/log/audit/*.log {
        weekly
        missingok
        compress
        #copytruncate
        rotate 30
        minsize 100k
        maxsize 200M
        postrotate
                touch /var/log/audit/audit.log ||:
                chmod 0600 /var/log/audit/audit.log ||:
                service auditd restart
        endscript
}

Stack Exchange Network

auditd not compressing logs during rotation

1 Answer 1

You must log in to answer this question.

Hot Network Questions

auditd not compressing logs during rotation

1 Answer 1

You must log in to answer this question.

Related

Hot Network Questions