On my CentOS linux machine, in my auditd.conf file, I have set my max_log_file_action=keep_logs.

However, in my /var/log/messages and /var/log/auditd.log, the following message appears multiple times a second which is filling up those log files quickly:

Audit daemon rotating log files with keep option 
Last known log disappeared (/data/log/audit.log.5) 
Next log to use will be /data/log/audit.log.5

Why are these messages appearing? Why so frequently? And how do I make them go away? they are incorrect nuisance messages (i.e., I'm not trying to rotate my auditd log).


Figured it out.

Note that my intent is to have a single log file - and not rotate it.

I also had num_logs set to 1. The spec is if num_logs is less than 2, it will not rotate. With this set to 1, it almost shouldn't matter what max_log_file_action is since there is no rotation. But with that set to "keep_logs" the system kept trying to rotate, and failing, and putting these messages into my messages and auditd.log files.

I set max_log_file_action to 'ignore'. I am now getting the desired behavior: single audit log file; no erroneous/extraneous messages in the messages and auditd.log files.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.