- auditd will stop writing to /var/log/audit/audit.log if there is not sufficient space available
- From experience, we know this works
- Unfortunately, it will not resume writing to /var/log/audit/audit.log when enough space has become available
- It will continue logging only after a restart of the auditd service
- How do we make auditd resume on its own?
- Red Hat Enterprise Linux (RHEL) 6
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.