On 11/5/05, Steve G <linux_4ever(a)yahoo.com> wrote:
>Is there something other than the size of the logfile that can be
>to cause the rotation? Would an RFE for a command to the deamon to cause
>a rotation be appropriate? How about something in the config file to
>tell it "daily" or similar?
OK. I thought about this problem. Keeping track of time and deciding when to
rotate is an ugly problem. What I decided to do is make sigusr1 force a rotation
of the logs.
I added a rotate command to the initscript so that you can do "service auditd
rotate". Then I created a small script that is stored in the docs directory,
/usr/share/doc/audit-1.0.10/auditd.cron, since I don't want it installed by
default. The script is intended to be used with cron so that you can force a
rotation at whatever is convenient - daily, weekly, every 12 hours.
Wouldnt it be better to add this to logrotate? There are several
programs that get rotated and get a signal to them to get to a new
log. The details being getting the signal without losing events or
soemthing.. need more sleep.
Stephen J Smoogen.
CSIRT/Linux System Administrator