AUDITD.CRON(5)

💖 AUDITD.CRON(5) — ok bestie, it's giving "rotating audit logs on a schedule" ✨

so this one lives in the System Administration Utilities corner of your manual pages, and it's literally all about time-based rotation of audit logs. buckle up, we're doing cron magic 🎀

🌸 NAME 🌸

auditd.conf — time-based rotation of audit logs

🦋 DESCRIPTION 🦋

okay so, by default, the audit daemon (auditd) is out here doing size-based log rotation. that means logs get rotated once they hit a specified size, and that size lives in /etc/audit/auditd.conf. very demure, very mindful, but not the whole story 💅

this manual is describing the alternative: time-based log rotation using cron. with this approach, your audit logs get rotated at specified intervals — hourly, daily, weekly, or even on a custom date — regardless of their size. no cap. size doesn't get a vote anymore. periodt. 🔥

✨ CONFIGURATION ✨

1. 🚫 Disable Size-Based Rotation

to enable time-based log rotation, first disable auditd's built-in size-based rotation by setting this parameter in /etc/audit/auditd.conf:

max_log_file_action = ignore

she's off duty, bestie 🙈

2. 📦 Configure Log Retention

the num_logs parameter is the one deciding how many rotated log files you keep. for daily rotation, setting

num_logs = 7

ensures that logs from the last seven days are retained. cute, right? a whole week of receipts 🧾✨

but — heads up — on busy systems, audit logs may grow rapidly, potentially leading to a lack of disk space 😭 to prevent this, make sure the space_left_action parameter is configured to handle low-disk-space situations appropriately. do not skip this one, fr fr.

3. 🔄 Apply Configuration Changes

after modifying the main auditd configuration file, reload auditd to apply the changes:

auditctl --signal reload

let her know the glow-up happened 💖

4. 🚀 Deploy the Rotation Script

copy the provided auditd.cron script to the appropriate cron directory (cron.daily or cron.hourly or cron.weekly, depending on your rotation preference). then, ensure the file has the correct SELinux labels:

cp /usr/share/doc/audit/auditd.cron /etc/cron.daily

SELinux labels are not a vibe you want to fumble, ngl. get those right 👑

👀 SEE ALSO 👀

• auditd.conf(5)
• auditd(8)
• cron(8)

🫶 AUTHOR 🫶

Attila Lakatos

and that's the whole page, bestie — brought to you by Red Hat, dated Feb 2025, manual name AUDITD.CRON(5). you ate that. go rotate some logs 💅🌸