audit log still getting rotated even with max_log_file_action = ignore?

DISCUSSION Bond Masuda 2 participants 5 messages Nov 2, 2015 – Nov 8, 2015

Share & tools

Bond Masuda

author

2015-11-02 21:40 UTC #0 lore raw

I'm seeing my /var/log/audit/audit.log getting rotated (I find a audit.1 or audit.2, etc. file) even though I have max_log_file_action=ignore. Here's the full auditd.conf:

log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = hostname
max_log_file = 6
max_log_file_action = ignore
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log disk_full_action = exec /usr/local/bin/remove_oldest_audit_log disk_error_action = SUSPEND
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd

what am I missing?

I have a cron job in /etc/cron.daily/auditd that I use to rotate + compress the audit logs, but this is not what is causing the audit log rotation.

Is there another setting I must set in order for it to not automatically rotate the audit log? How do I achieve the desired effect, where the audit log is only rotated when my cron script runs?

Thanks,
Bond

Steve Grubb

2015-11-02 23:32 UTC #1 lore raw

Quoted 29 lines · Bond Masuda

I'm seeing my /var/log/audit/audit.log getting rotated (I find a audit.1 or audit.2, etc. file) even though I have max_log_file_action=ignore. Here's the full auditd.conf:
log_file = /var/log/audit/audit.log
log_format = RAW
log_group = root
priority_boost = 4
flush = INCREMENTAL
freq = 20
num_logs = 5
disp_qos = lossy
dispatcher = /sbin/audispd
name_format = hostname
max_log_file = 6
max_log_file_action = ignore
space_left = 75
space_left_action = email
action_mail_acct = root
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log disk_full_action = exec /usr/local/bin/remove_oldest_audit_log disk_error_action = SUSPEND
tcp_listen_queue = 5
tcp_max_per_addr = 1
tcp_client_max_idle = 0
enable_krb5 = no
krb5_principal = auditd

Quoted 1 line

what am I missing?

I took a quick look at the code. I can't see how this is happening unless auditd is receiving a SIGUSR1 signal.

You might want to put some syslog calls in to auditd-event.c log when auditd gets told to rotate so that it can be correlated to other system activities.

-Steve

Quoted 7 lines

I have a cron job in /etc/cron.daily/auditd that I use to rotate + compress the audit logs, but this is not what is causing the audit log rotation.
Is there another setting I must set in order for it to not automatically rotate the audit log? How do I achieve the desired effect, where the audit log is only rotated when my cron script runs?

Bond Masuda

author

2015-11-06 18:07 UTC #2 lore raw

Quoted 4 lines · Steve Grubb

I took a quick look at the code. I can't see how this is happening unless auditd is receiving a SIGUSR1 signal. You might want to put some syslog calls in to auditd-event.c log when auditd gets told to rotate so that it can be correlated to other system activities. -Steve

Hi Steve,

The cron script i mention below does use "service auditd rotate", which does send a SIGUSR1. But these rotations are happening outside the time frame when that cron job runs. Additionally, they seem to rotate around when the log file reaches about 90MB. It almost seems like there's some default behavior? I was wondering if maybe my syntax in the config file was wrong and auditd was ignoring my setting and just using defaults?

Bond

Quoted 7 lines

Quoted 7 lines
I have a cron job in /etc/cron.daily/auditd that I use to rotate + compress the audit logs, but this is not what is causing the audit log rotation.
Is there another setting I must set in order for it to not automatically rotate the audit log? How do I achieve the desired effect, where the audit log is only rotated when my cron script runs?

Steve Grubb

2015-11-06 19:12 UTC #3 lore raw

Quoted 11 lines · Bond Masuda

Quoted 4 lines · Steve Grubb
I took a quick look at the code. I can't see how this is happening unless auditd is receiving a SIGUSR1 signal. You might want to put some syslog calls in to auditd-event.c log when auditd gets told to rotate so that it can be correlated to other system activities. -Steve
Hi Steve,
The cron script i mention below does use "service auditd rotate", which does send a SIGUSR1. But these rotations are happening outside the time frame when that cron job runs.

Can you find any other cron job running around that time?

Quoted 2 lines

Additionally, they seem to rotate around when the log file reaches about 90MB. It almost seems like there's some default behavior?

The settings to note in your email are these:

num_logs = 5
max_log_file = 6
max_log_file_action = ignore
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log

This means you would have 6 log files that 5 MB each. However, the max_log_file action says ignore.

Quoted 2 lines

I was wondering if maybe my syntax in the config file was wrong and auditd was ignoring my setting and just using defaults?

It might be that you are hitting the admin_space_left_action which runs remove_oldest_audit_log. That is my only guess. Does the math work out for partition size - size of all logs being approximayely 50MB? If so, this is your problem and you might need a bigger partition.

But based on a quick review of the man page, you might set num_logs = 0. That is supposed to disable rotating as long as max_log_size_action != rotate. You have ignore, so that should work if you don't have the problem noted above.

-Steve

Quoted 7 lines

Quoted 7 lines
Quoted 7 lines
I have a cron job in /etc/cron.daily/auditd that I use to rotate + compress the audit logs, but this is not what is causing the audit log rotation.
Is there another setting I must set in order for it to not automatically rotate the audit log? How do I achieve the desired effect, where the audit log is only rotated when my cron script runs?

Bond Masuda

author

2015-11-08 06:05 UTC #4 lore raw

Quoted 6 lines · Steve Grubb

Quoted 5 lines · Bond Masuda
Quoted 4 lines · Steve Grubb
I took a quick look at the code. I can't see how this is happening unless auditd is receiving a SIGUSR1 signal. You might want to put some syslog calls in to auditd-event.c log when auditd gets told to rotate so that it can be correlated to other system activities. -Steve

Quoted 7 lines

Quoted 5 lines
Hi Steve,
The cron script i mention below does use "service auditd rotate", which does send a SIGUSR1. But these rotations are happening outside the time frame when that cron job runs.
Can you find any other cron job running around that time?

I'm still trying to hunt this down; haven't found anything thus far, but its possible I could have missed something.

Quoted 14 lines

Quoted 2 lines
Additionally, they seem to rotate around when the log file reaches about 90MB. It almost seems like there's some default behavior?
The settings to note in your email are these:
num_logs = 5
max_log_file = 6
max_log_file_action = ignore
admin_space_left = 50
admin_space_left_action = exec /usr/local/bin/remove_oldest_audit_log
This means you would have 6 log files that 5 MB each. However, the max_log_file action says ignore.

Quoted 6 lines

Quoted 2 lines
I was wondering if maybe my syntax in the config file was wrong and auditd was ignoring my setting and just using defaults?
It might be that you are hitting the admin_space_left_action which runs remove_oldest_audit_log. That is my only guess. Does the math work out for partition size - size of all logs being approximayely 50MB? If so, this is your problem and you might need a bigger partition.

I don't think that's the case:

# df -h /var/log/audit/
Filesystem            Size  Used Avail Use% Mounted on
/dev/mapper/vg_system-lv_audit
                     1014M  413M  602M  41% /audit

Quoted 6 lines

But based on a quick review of the man page, you might set num_logs = 0. That is supposed to disable rotating as long as max_log_size_action != rotate. You have ignore, so that should work if you don't have the problem noted above.
-Steve

Ok, will try this and see if that unexpected rotation goes away.

Thanks,
Bond