auditd.conf - time-based rotation of audit logs

Attila Lakatos Red Hat Feb 2025 AUDITD.CRON(5)

1.DisableSize-BasedRotation: To enable time-based log rotation, first disable auditd's built-in size-based rotation by setting the following parameter in /etc/audit/auditd.conf: max_log_file_action = ignore 2.ConfigureLogRetention: The num_logs parameter determines the number of rotated log files to keep. For daily rotation, setting num_logs = 7 ensures that logs from the last seven days are retained. However, on busy systems, audit logs may grow rapidly, potentially leading to a lack of disk space. To prevent this, ensure that the space_left_action parameter is configured to handle low-disk-space situations appropriately. 3.ApplyConfigurationChanges: After modifying the main auditd configuration file, reload auditd to apply the changes: auditctl --signal reload 4.DeploytheRotationScript: Copy the provided auditd.cron script to the appropriate cron directory ( cron.daily or cron.hourly or cron.weekly , depending on your rotation preference). Then, ensure the file has the correct SELinux labels: cp /usr/share/doc/audit/auditd.cron /etc/cron.daily

By default, the audit daemon (auditd) supports size-based log rotation, where logs are rotated once they reach a specified size, as configured in /etc/audit/auditd.conf. This manual describes an alternative method: time-based log rotation using cron. Using this approach, audit logs can be rotated at specified intervals (hourly, daily, weekly or on a custom date), regardless of their size.

auditd.conf - time-based rotation of audit logs

auditd.conf(5), auditd(8), cron(8).