Sample Header Ad - 728x90

Linux Audit log rotation name and compression RHEL CentOS 7

2 votes
1 answer
12183 views
Want to set either a **weekly** or **monthly** saving of the real-time /var/log/audit/audit.log file to a compressed file having the name such as audit_2020-05-05.log.gz In **RHEL/CentOS 7.x** is there an **elegant** way to make the following happen all within existing audit **.conf** files ? Otherwise is the *best* way to simply do a root crontab that will run a homegrown bash shell script that will... - service auditd stop - cp /var/log/audit/audit.log /var/log/audit/audit_.log - service auditd start - gzip -9 /var/log/audit/audit_.log I would prefer to make the above happen by doing it within the confines of the /etc/audit/ files if that is possible which is why I am asking. But I strongly want audit_.log.gz files to come about every week/month with that specific file naming convention. The ultimate goal is a reliable and robust way of managing the created audit log archives... keeping any one saved audit log text file to be less than 1GB in size uncompressed so adjusting the log saving/rotation accordingly. But also to not lose any audit log or bring the system to single user mode based on audit.conf settings. So any *better* way than what I am currently thinking I would be happy to hear about.
Asked by ron (8647 rep)
May 14, 2020, 02:11 AM
Last activity: Aug 14, 2023, 01:32 PM