Jason --

Regarding symlinks ...

I am concerned that it will run twice, hourly at 03:01 [A] and again at 03:05 [B]. If that happens, and the compression takes 4+ minutes, then I have to start adding lock files, calculating time differential from lockfile, etc... It's going to get complicated really quick.

Right now it's taken only 15s/GiB, so we're usually finishing well under 1 minute. And the reason we're doing it every hour is so we're only taking 15-30s/hour to compress, and saving 97% of disk space (gzip -9, just like logrotate offers to do with compression). After 24 hours, we could be seeing 50GiB+, and that will take 15 minutes to compress, not to mention we'll probably fill up our /var/log[/audit] by then.

Regarding why not just use logrotate ...

While we did modify /etc/logrotate.conf to use (logfile).%s, that still doesn't address ... - auditd (most specifically) and a few other programs that work differently and cannot just be added to /etc/logrotate.d/ - programs that don't compress, and generate .1, -2, _3 and similar, and then we cannot compress them because .1.gz, -2.gz, _3.gz already exist. - systems where we are not allowed to modify /etc/logrotate.conf

In that case, dropping in this /etc/cron.hourly/zlogs.cron script is a nice, even if partially redundant in some cases, solution. Understand some of our systems are generating GiBs/hour in audit logs alone. Again, audit != logrotate, and even Red Hat (somehow) copies (from /usr/share/doc/audit-*/) to /etc/cron.daily/auditd.cron file (which is what I'm trying to figure out when and how often -- like on a RPM update).

NOTES:

[A] cron.hourly -- per /etc/crond.d/0hourly, :01 after the hour

[B] cron.daily -- per /etc/anacrontab, START_HOURS_RANGE=3-22, delay in minutes for daily = 5

R. Hinton --

Do you have auditd installed, configured and, most importantly, with rules? E.g., /etc/audit/audit.rules /etc/audit/rules.d/* (in addition to /etc/audit/auditd.conf), plus chkconfig on?

-- bjs

Just FYI, I'm looking for how "/etc/cron.daily/auditd.cron" is being created. I will run this on a Kickstarted system to see if it is created by the "auditd" process itself.

BTW, the "/etc/audit/auditd.conf" file is part of package "audit", and I've already created the "trigger" in my zlogs.spec file for my RPM to backup/replace that file if the package "auditd" is installed, updated, etc...

...
%files
%defattr(-,root,root,-)
%attr(600,root,root) /etc/audit/auditd.conf_archive
...

%triggerin -- audit
#   Executed if audit is installed, aleady installed or upgraded
# Backup and replace /etc/audit/auditd.conf, and restart auditd
/bin/cp -p /etc/audit/auditd.conf /etc/audit/auditd.conf_`/bin/date +%s`
/bin/cp -f /etc/audit/auditd.conf_archive /etc/audit/auditd.conf
/sbin/service auditd reload
# Move any auditd.cron logrotation script to /etc/cron.hourly
if [ ! -e "/etc/cron.hourly/auditd.cron" ] ; then
    if [ -e "/etc/cron.daily/auditd.cron" ] ; then
        /bin/mv -f "/etc/cron.daily/auditd.cron" "/etc/cron.hourly/" 2>> /dev/null
    elif [ -e "/etc/cron.weekly/auditd.cron" ] ; then
        /bin/mv -f "/etc/cron.weekly/auditd.cron" "/etc/cron.hourly/" 2>> /dev/null
    elif [ -e "/etc/cron.monthly/auditd.cron" ] ; then
        /bin/mv -f "/etc/cron.monthly/auditd.cron" "/etc/cron.hourly/" 2>> /dev/null
    else
        f="/.invalidfile"
        # Look for auditd.cron script in the /usr/share/doc/audit-*/ directory(ies)
        for p in /usr/share/doc/audit-*/auditd.cron ; do f="${p}" ; done
        if [ -r "${f}" ] ; then
            # Copy, instead of move
            /bin/cp -n "${f}" /etc/cron.hourly/ 2>> /dev/null
            /bin/chmod 700 /etc/cron.hourly/auditd.cron 2>> /dev/null
            /sbin/restorecon /etc/cron.hourly/auditd.cron 2>> /dev/null
        fi
    fi
fi
...

To reduce revisiting this over and over (since it has happened several times now, not trying to single anyone out), I have added the following to the top of the Discussion ... ;)

PREFACE (EDIT): Please keep in mind 2 things before posting, as they have been visited several times and are not part of our issue.

1) Before we posted this, we had already done the following RPM commands: -qf (RPM [what]provides), -q --scripts (RPM scripts), -q --triggers (RPM triggers). We are trying to figure out what process is copying the file /usr/share/doc/audit-*/auditd.cron to /etc/cron.daily. It seems to be a post-installation process not in any RPM, file, script or trigger.

2) We are not using logrotate for audit, period. auditd.cron and logrotate are for different sets of files, as part of a greater solution reduce disk usage for logging and auditing. We use logrotate and its inherent (zip -9) compression for those files in logrotate which, again, does not include auditd's logs. We are also using other scripts -- cron.hourly/zlogs.cron (ORIGINAL) and cron.monthly/arclogs.cron (NEW) -- to rename/compress audit and other log files as well as move them to another file system. The latter, normally run monthly, even gets automatically kicked off, per audit/auditd.conf, when the file system drops to under 0.5GiB free.