From owner-freebsd-security@freebsd.org  Sat Jan  9 19:04:45 2016
Return-Path: <owner-freebsd-security@freebsd.org>
Delivered-To: freebsd-security@mailman.ysv.freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org
 [IPv6:2001:1900:2254:206a::19:1])
 by mailman.ysv.freebsd.org (Postfix) with ESMTP id 0CF14A69539
 for <freebsd-security@mailman.ysv.freebsd.org>;
 Sat,  9 Jan 2016 19:04:45 +0000 (UTC) (envelope-from lev@FreeBSD.org)
Received: from onlyone.friendlyhosting.spb.ru (onlyone.friendlyhosting.spb.ru
 [IPv6:2a01:4f8:131:60a2::2])
 by mx1.freebsd.org (Postfix) with ESMTP id D0A8B1FD8
 for <freebsd-security@freebsd.org>; Sat,  9 Jan 2016 19:04:44 +0000 (UTC)
 (envelope-from lev@FreeBSD.org)
Received: from [IPv6:2001:470:923f:2:8d26:421:28d8:8fed] (unknown
 [IPv6:2001:470:923f:2:8d26:421:28d8:8fed])
 (Authenticated sender: lev@serebryakov.spb.ru)
 by onlyone.friendlyhosting.spb.ru (Postfix) with ESMTPSA id 236BB205C3
 for <freebsd-security@freebsd.org>; Sat,  9 Jan 2016 22:04:42 +0300 (MSK)
Message-ID: <569159E6.1040206@FreeBSD.org>
Date: Sat, 09 Jan 2016 22:05:10 +0300
From: Lev Serebryakov <lev@FreeBSD.org>
Reply-To: lev@FreeBSD.org
Organization: FreeBSD
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64;
 rv:31.0) Gecko/20100101 Thunderbird/31.7.0
MIME-Version: 1.0
To: freebsd-security@freebsd.org
Subject: Does audit_control's "expire-after" by size works?
Content-Type: text/plain; charset=utf-8
Content-Transfer-Encoding: 7bit
X-BeenThere: freebsd-security@freebsd.org
X-Mailman-Version: 2.1.20
Precedence: list
List-Id: "Security issues \[members-only posting\]"
 <freebsd-security.freebsd.org>
List-Unsubscribe: <https://lists.freebsd.org/mailman/options/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/freebsd-security/>
List-Post: <mailto:freebsd-security@freebsd.org>
List-Help: <mailto:freebsd-security-request@freebsd.org?subject=help>
List-Subscribe: <https://lists.freebsd.org/mailman/listinfo/freebsd-security>, 
 <mailto:freebsd-security-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 09 Jan 2016 19:04:45 -0000

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512


 I have this:

expire-after:356d AND 5G

 and now my /var/audit contains 1 year of files, but it takes 105
gigabytes (!).

 It is FreeBSD 10.2-STABLE r286784

- -- 
// Lev Serebryakov AKA Black Lion
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v2.0.22 (MingW32)

iQJ8BAEBCgBmBQJWkVnmXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w
ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRGOTZEMUNBMEI1RjQzMThCNjc0QjMzMEFF
QUIwM0M1OEJGREM0NzhGAAoJEOqwPFi/3EePsaEQANOzTdAKKSRbMNt4bP/LFO4K
RlzpI1knJWFSvwxxOIaGLxVa7vh/r2aLvoVVswlftS62svh2T7yvRf4vJQYXzsTw
Ix2sDgIgMulxHsoKGHStqZz8M9XQjJQamOSX5YZCjcaccsunWUKSUQSNPUEW4sHA
ZAWNEUM3vDTYko+BA8/6/Iy4fNcz8aNhhLv/Vfz0auR1OCHKgZK74AeVtJo2q/Xp
r6y8EC6+YL6LNb0UBiJJWThYe0rPHNG0NADZl2PPNgP3n48D+gq254QL0vSYlgB6
6Snfa0NjhZ6xeIYfKufooTizG3t9Kk67r5JV9ssxqQltdlN05rqJAMDZhJYMfQRS
ayh5wHK4eCJXmqn+/bbQbqspf1lJPHNmsZD6gUkYAjqcyjSoDtFDe3rdIkgeJ2ZV
ERiwPe3UXBk1qLLpcfRJMKPr3stlwf+MSFd3U0Qg0IblJOvVJ68KrWX45SlPWlOO
qL7iNUjh0gMMhjcSY0Fs7tWDXvbcbl8SIynazi0s3+CIH4BYkunoiNf5AKkOUG86
UMcY2Wx09IxZZK+UcCCvhx+NaMrvYSCybhNZpPRyzRbrpgBbQpX+HrBvVAyJRlX0
J9yBQXKPGCFJHqu56g6MqFZbX9KiJ5Tzt6VvajJdgTMkHDpxWHeki9ZWlibebCwq
xt0N0/du+QBuYZpNUx/C
=1nfI
-----END PGP SIGNATURE-----