Super User is a question and answer site for computer enthusiasts and power users. Join them; it only takes a minute:

Sign up
Here's how it works:
  1. Anybody can ask a question
  2. Anybody can answer
  3. The best answers are voted up and rise to the top

I am using auditctl to log all commands run on my Ubuntu system and I working on a script that parses the log into a more readable format. Since these logs tend to become very large, I want to periodically delete the logs. I found that by running

sudo rm /var/log/audit/*

I would get

rm: cannot remove `/var/log/audit/*': No such file or directory

however by running

sudo su
rm /var/log/audit/*

The logs would be deleted without any problem. What could be the cause of this?

share|improve this question
up vote 3 down vote accepted

Filename expansion is the cause of the problem.

The shell is expanding /var/log/audit/* as your current, non-root user.

As that user doesn't have read/exec access to /var/log/audit, rm is getting passed, instead of a list of files to delete that are all in that directory, the literal string


rm is correct - there IS no file named "*" in /var/log/audit - so it can't delete it.

Try this:

sudo 'rm /var/log/audit/*'

or maybe:

sudo sh -c 'rm /var/log/audit/*'
share|improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .