Why does auditd not resume logging after space is made available in /var/log?
Issue
- auditd will stop writing to /var/log/audit/audit.log if there is not sufficient space available
- From experience, we know this works
- Unfortunately, it will not resume writing to /var/log/audit/audit.log when enough space has become available
- It will continue logging only after a restart of the auditd service
- How do we make auditd resume on its own?
Environment
- Red Hat Enterprise Linux (RHEL) 6
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.
