Red Hat Enterprise Linux 5 Administration Unleashed

506CHAPTER 25Linux Auditing System. Setting a dedicated log file for audit messages. Determining whether or not the log file is rotated. Enabling warnings if the log files start to take up too much disk space. Configuring audit rules to log more detailed information. Activating file and directory watchesThese settings and more are configured in the /etc/audit/auditd.conf file, whichcontains options to modify the behavior of the audit daemon. Each option should be ona separate line followed by an equals sign (=) and the value for the option. Listing 25.1shows the default configuration file.LISTING 25.1Default Audit Daemon Parameters## This file controls the configuration of the audit daemon#log_file = /var/log/audit/audit.loglog_format = RAWpriority_boost = 3flush = INCREMENTALfreq = 20num_logs = 4dispatcher = /sbin/audispddisp_qos = lossymax_log_file = 5max_log_file_action = ROTATEspace_left = 75space_left_action = SYSLOGaction_mail_acct = rootadmin_space_left = 50admin_space_left_action = SUSPENDdisk_full_action = SUSPENDdisk_error_action = SUSPENDThe following options can be configured (refer to Listing 25.1 for the default values):log_fileFull path to the audit log file. If you configure the daemon to write logs to a directoryother than the default /var/log/audit/, be sure to change the file permissionson it so that only root has read, write, and execute permissions. All otherusers should not be able to access the directory or the log files in the directory.