space_left_action
Good news: When I set the space_left_action to syslog and crossed the boundary, I got a syslog message on the next audit event. Subsequent events did not generate any further syslog messages.
Then I freed up disk space, sent in a few events for good measure (thinking it would reset the flag) and once again filled the disk past the threshold.
Bad news: I didn't get the message again.
Should this behavior have happened as I expected and another log message get into the messages log? Or as coded would the auditd need restart?
Thx,
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]
Quoted 8 lines · LC Bruzenak
Good news: When I set the
space_left_actionto syslog and crossed the boundary, I got a syslog message on the next audit event. Subsequent events did not generate any further syslog messages.Then I freed up disk space, sent in a few events for good measure (thinking it would reset the flag) and once again filled the disk past the threshold.
Bad news: I didn't get the message again.
Did you do a "service auditd resume" ?
Quoted 2 lines
Should this behavior have happened as I expected and another log message get into the messages log? Or as coded would the auditd need restart?
You shouldn't need to restart it, but you should tell it to resume.
-Steve
Quoted 10 lines · Steve Grubb
Quoted 8 lines · LC Bruzenak
Good news: When I set the
space_left_actionto syslog and crossed the boundary, I got a syslog message on the next audit event. Subsequent events did not generate any further syslog messages.Then I freed up disk space, sent in a few events for good measure (thinking it would reset the flag) and once again filled the disk past the threshold.
Bad news: I didn't get the message again.
Quoted 8 lines
Did you do a "service auditd resume" ?
Quoted 2 lines
Should this behavior have happened as I expected and another log message get into the messages log? Or as coded would the auditd need restart?
You shouldn't need to restart it, but you should tell it to resume.
-Steve
Thanks for the info Steve!
I would think the manual resume option appropriate definitely for the "suspend" option...but not really the syslog.
Is there a reason to not have it reset if the space is freed?
So if eventually I need to patch this, would you:
1: accept a change?
2: also want another parameter like "autoresume_on_space_free = false" to preserve this behavior?
Thanks,
LCB.
Signature · 2 lines
LC (Lenny) Bruzenak [email protected]