Date: Tue, 28 Sep 2021 21:18:36 +0000 From: JB <freebsdlists.admin@protonmail.com> To: Dan Langille <dan@langille.org> Cc: freebsd-questions@freebsd.org Subject: Re: auditdistd - audit trail file retntion Message-ID: <DLShptKZG1uy-pkaC3TaStlywF7jXshKE465rL2Mq_BfnZUVLyPalv-Py6jDrsT-Hh1zXwkkeb_py6_Pkxdo9M1OoZbPtnFKYIRHfVLh8RY=@protonmail.com> In-Reply-To: <587952f9-71e1-590c-aacb-1a4c8be7e053@langille.org> References: <63FzSG9SYK55EYli0V-lgAHWQu0WKoRYoAz1IFKsq8kpIoC3TXLG765IctTawyK_DAYGU4yRzG_MPYFm6bfCujEEMLjPtLumNDhAUcsQO0E=@protonmail.com> <b6529db9-8e0a-d501-4d96-6c729e935915@langille.org> <v4632GyTjZmLX0I1eou7Dw-ittzfYz2hbkSjNdc9DMhzZ2aj16zaL0HCPgtwqrAHEMfYBvgNiH3a_quSP_s_VYjln-X2-j-uD-rTmsczI0Q=@protonmail.com> <587952f9-71e1-590c-aacb-1a4c8be7e053@langille.org>
next in thread | previous in thread | raw e-mail | index | archive | help
On Tuesday, September 28th, 2021 at 7:34 AM, Dan Langille <dan@langille.org> wrote:
> > Date: Mon, 20 Sep 2021 11:07:34 -0400
> > From: Dan Langille dan@langille.org
> > To: "freebsd-questions@freebsd.org" freebsd-questions@freebsd.org
> > Cc: Pawel Jakub Dawidek pjd@freebsd.org
> > Subject: auditdistd - audit trail file retntion
> >
> > Hello,
> >
> > I am using auditdistd on FreeBSD 11.4 and 12.2 - I write about audit
> > trail files retention.
> >
> > Is there an option to dispose of older logs in /var/audit/dist ?
> >
> > So far, it seems like a custom cronjob is in order. Something like:
> >
> > ??? /usr/bin/find /var/audit/dist -type f -mtime +7 -exec rm {} \;
> >
> > FYI: I have read up about auditd, /etc/security/audit_control, and the
> > audit -e option. They do not apply to auditdistd.
> >
> > Thank you.
> >
> This is what I'm using from a periodic daily script:
>
> /usr/bin/find -E /var/audit/dist -type f -mtime +7 -regex "/var/audit/dist/[0-9]+.[0-9]+" -exec rm {} \;
>
> Dan Langille
>
> dan@langille.org
Looks good. You can use the "-delete" flag instead of "-exec rm {} \;" but it shouldn't make much difference. Also, the `cron' default PATH includes /usr/bin, so you can probably just use `find' instead of absolute path (that's why the "-exec rm" isn't complaining about a missing `rm' program).
Again not that it makes much difference, but you can use the exclusion "!" flag to match the single "*.not_terminated" file, then nuke all other files inside that dir without needing the "-regex".
find /var/audit/dist/ ! -name "*.not_terminated" -type f -mtime +7 -delete
Sent with ProtonMail Secure Email.
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?DLShptKZG1uy-pkaC3TaStlywF7jXshKE465rL2Mq_BfnZUVLyPalv-Py6jDrsT-Hh1zXwkkeb_py6_Pkxdo9M1OoZbPtnFKYIRHfVLh8RY=>