Why does auditd not resume logging after space is made available in /var/log?
Issue
- auditd will stop writing to /var/log/audit/audit.log if there is not sufficient space available
- From experience, we know this works
- Unfortunately, it will not resume writing to /var/log/audit/audit.log when enough space has become available
- It will continue logging only after a restart of the auditd service
- How do we make auditd resume on its own?
Environment
- Red Hat Enterprise Linux (RHEL) 6
- auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase of over 48,000 articles and solutions.
Close
Welcome! Check out the Getting Started with Red Hat page for quick tours and guides for common tasks.