force audit log rotation?

[Dominick Grift]

On Tue, 2012-04-10 at 15:48 +0200, Dominick Grift wrote:
> On Tue, 2012-04-10 at 08:26 -0400, Dr. Michael J. Chudobiak wrote:
> > Hi all,
> > 
> > How do I force an audit.log rotation in a systemd world (F16)?
> > 
> > "service auditd rotate" no longer works, of course.
> > 
> > - Mike
> 
> This seems to work for me:
> 
> systemctl kill -s SIGUSR1 auditd.service
> 

I think that auditd.cron needs to be edited:

# diff
-u /usr/share/doc/audit-2.2.1/auditd.cron /etc/cron.hourly/auditd.cron
--- /usr/share/doc/audit-2.2.1/auditd.cron	2012-03-23 13:42:39.000000000
+0100
+++ /etc/cron.hourly/auditd.cron	2012-04-10 16:51:11.813528608 +0200
@@ -5,7 +5,9 @@
 # based on a cron job.
 ##########
 
-/sbin/service auditd rotate
+# /sbin/service auditd rotate
+systemctl kill -s SIGUSR1 auditd.service
+
 EXITVALUE=$?
 if [ $EXITVALUE != 0 ]; then
     /usr/bin/logger -t auditd "ALERT exited abnormally with
[$EXITVALUE]"




> > --
> > selinux mailing list
> > selinux at lists.fedoraproject.org
> > https://admin.fedoraproject.org/mailman/listinfo/selinux
> 
>