Oracle Solaris System Administration (MOSC)

MOSC Banner

Auditd and log rotation

edited Oct 20, 2011 9:12PM in Oracle Solaris System Administration (MOSC) 6 comments
Ok folks,

 I am trying set up auditd via BSM, which is fine, but I want to rotate these binary logs.  I figure logadm will do the trick, but I seem to be haveing trouble.  Can anyone give me advise on this statement...

logadm -C365 -p 1d -b "/usr/sbin/audit -n" -a "rm /var/audit/[0-9*]*.[0-9*]*.*" -t '/var/audit/archive/$nodename.$n' '/var/audit/[0-9*]*.[0-9*]*.*'

My logic....

-C365 >>>> keep 365 copies of the logs

-p 1d >>>> rotate daily

-b "/usr/sbin/audit -n" >>>> (precommand) use audit -n to have the sudit deamon close the current log and create another one.  No audit data is lost this way.

Howdy, Stranger!

Log In

To view full details, sign in to My Oracle Support Community.

Register

Don't have a My Oracle Support Community account? Click here to get started.

Category Leaderboard

Top contributors this month

New to My Oracle Support Community? Visit our Welcome Center

MOSC Help Center