Date: Sat, 9 Jan 2016 21:55:42 +0100 From: Terje Elde <terje@elde.net> To: lev@FreeBSD.org Cc: freebsd-security@freebsd.org Subject: Re: Does audit_control's "expire-after" by size works? Message-ID: <89CCB3E8-4E81-4673-B04B-E3B8A25CBE76@elde.net> In-Reply-To: <569159E6.1040206@FreeBSD.org> References: <569159E6.1040206@FreeBSD.org>
next in thread | previous in thread | raw e-mail | index | archive | help
> On 09 Jan 2016, at 20:05, Lev Serebryakov <lev@FreeBSD.org> wrote: >=20 > I have this: >=20 > expire-after:356d AND 5G >=20 > and now my /var/audit contains 1 year of files, but it takes 105 > gigabytes (!). >=20 > It is FreeBSD 10.2-STABLE r286784 I don't recall how that limit is implemented, but it could be related to thi= s: https://www.freebsd.org/security/advisories/FreeBSD-EN-15:19.kqueue.asc Terje
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?89CCB3E8-4E81-4673-B04B-E3B8A25CBE76>