PDA

View Full Version : Problems with Audit

bluesin
02-24-2006, 01:57 PM
I did some digging on the problem I reported in this thread http://www.interworx.com/forums/showthread.php?t=1146

I checked the var/log/audit.d directory and there were a few thousand 20mb save.* files which had basically filled up almost my entire disk space. ( > 50 gig worth)

I found this bug report at redhat https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=130071

The audit was being suspended as per the updates required with this command

"/usr/sbin/audbin -S /var/log/audit.d/save.%u -C -T 20%"


Which suspends audit, but it aparently also suspends cron execution when it happens also...

Any idea how I can turn this off completely?
IWorx-Chris
02-24-2006, 02:14 PM
You can just remove audit from the system bluesin:

yum remove autit

should do it.

Chris
bluesin
02-24-2006, 02:22 PM
Thanks chris, do you see any area where I would need it? And would it possibly get reinstalled with an update?
IWorx-Chris
02-24-2006, 02:25 PM
We usually remove audit from our boxes, it's resource intensive and as you saw can eat up some disk space too :). If you remove it yum won't update (re-add) it later on.

Chris
bluesin
02-24-2006, 02:35 PM
Is that the name of it, or is it laus, I get no matches for audit...
IWorx-Chris
02-24-2006, 02:37 PM
Do a:

rpm -qa | grep audit

and you'll get a list of most/all things related to the audit subsystem.

Chris
bluesin
02-24-2006, 03:07 PM
Nothing for audit, do get it for "laus"
bluesin
02-24-2006, 03:49 PM
Chris, in the audit.conf file,

I changed this

notify = "/usr/sbin/audbin -S /var/log/audit.d/save.%u -C -T 20%";

to this
notify = "/usr/sbin/audbin -S /var/log/audit.d/save.%u -C -T 99% -N 'rm -f %f'";

Which should delete the latest save file, I also removed the "type = suspend" action from the action list which should keep it from suspending audit, as my disk is definately more than 1% used...

I think that should work...
IWorx-Chris
02-24-2006, 04:02 PM
What distro are you running bluesin?
bluesin
02-24-2006, 05:50 PM
Red Hat Enterprise Linux ES release 3 (Taroon Update 4)...
bluesin
02-26-2006, 06:55 PM
FYI, for anyone interested, I just changed this to

notify = "/usr/sbin/audbin -C"

Which just clears the audit log file without saving it at all...