auditdistd - audit trail file retntion

[JB]

On Tuesday, September 28th, 2021 at 7:34 AM, Dan Langille <dan at langille.org> wrote:

> > Date: Mon, 20 Sep 2021 11:07:34 -0400
> > From: Dan Langille dan at langille.org
> > To: "freebsd-questions at freebsd.org" freebsd-questions at freebsd.org
> > Cc: Pawel Jakub Dawidek pjd at freebsd.org
> > Subject: auditdistd - audit trail file retntion
> >
> > Hello,
> >
> > I am using auditdistd on FreeBSD 11.4 and 12.2 - I write about audit
> > trail files retention.
> >
> > Is there an option to dispose of older logs in /var/audit/dist ?
> >
> > So far, it seems like a custom cronjob is in order. Something like:
> >
> > ??? /usr/bin/find /var/audit/dist -type f -mtime +7 -exec rm {} \;
> >
> > FYI: I have read up about auditd, /etc/security/audit_control, and the
> > audit -e option. They do not apply to auditdistd.
> >
> > Thank you.
> >
> This is what I'm using from a periodic daily script:
>
>     /usr/bin/find -E /var/audit/dist -type f -mtime +7 -regex "/var/audit/dist/[0-9]+.[0-9]+" -exec rm {} \;
>
> Dan Langille
>
> dan at langille.org

Looks good. You can use the "-delete" flag instead of "-exec rm {} \;" but it shouldn't make much difference. Also, the `cron' default PATH includes /usr/bin, so you can probably just use `find' instead of absolute path (that's why the "-exec rm" isn't complaining about a missing `rm' program).

Again not that it makes much difference, but you can use the exclusion "!" flag to match the single "*.not_terminated" file, then nuke all other files inside that dir without needing the "-regex".

find /var/audit/dist/ ! -name "*.not_terminated" -type f -mtime +7 -delete

Sent with ProtonMail Secure Email.