Auditd and log rotation
I am trying set up auditd via BSM, which is fine, but I want to rotate these binary logs. I figure logadm will do the trick, but I seem to be haveing trouble. Can anyone give me advise on this statement...
logadm -C365 -p 1d -b "/usr/sbin/audit -n" -a "rm /var/audit/[0-9*]*.[0-9*]*.*" -t '/var/audit/archive/$nodename.$n' '/var/audit/[0-9*]*.[0-9*]*.*'
My logic....
-C365 >>>> keep 365 copies of the logs
-p 1d >>>> rotate daily
-b "/usr/sbin/audit -n" >>>> (precommand) use audit -n to have the sudit deamon close the current log and create another one. No audit data is lost this way.