hi,

our ca master role got its /var/log disk full and after a quick analysis the directory /var/log/pki/pki-tomcat/ca/signedAudit was the problem.

First time I come across this problem after 10 years ;-)

This directory has a lot of files called ca_audit.yyyymmddhhmmss, each 2M large. It ended up costing 30G in total before we noticed.

So the quick fix was fast, deleting files, but what can I tweak to not have this happen again in the future? And is this auditing crucial for some process? Or can it be turned off somewhere?

Thanks in advance for your input.