My Oracle Support Banner

Oracle Linux : System Log Frequent Reports "Audit daemon rotating log files" (Doc ID 2909754.1)

Last updated on SEPTEMBER 26, 2024

Applies to:

Linux OS - Version Oracle Linux 7.9 with Unbreakable Enterprise Kernel [5.4.17] and later
Linux x86-64

Symptoms

On an Oracle Linux 7 (OL7) system with system auditing (auditd) enabled, the system log (/var/log/messages) frequently reports Audit daemon rotating log files


The auditd logs (/var/log/auditd) fill and rotate very quickly causing the /var filesystem to run out of free disk space e.g.:

Changes

 System auditing rules to track the execution of a script (alert_scan_cstx.sh) was recently put into effect.

Cause

To view full details, sign in with your My Oracle Support account.

Don't have a My Oracle Support account? Click to get started!

In this Document
Symptoms
Changes
Cause
Solution
References


My Oracle Support provides customers with access to over a million knowledge articles and a vibrant support community of peers and Oracle experts.