Skip site navigation (1)Skip section navigation (2)
Date:      Sat, 9 Jan 2016 21:55:42 +0100
From:      Terje Elde <terje@elde.net>
To:        lev@FreeBSD.org
Cc:        freebsd-security@freebsd.org
Subject:   Re: Does audit_control's "expire-after" by size works?
Message-ID:  <89CCB3E8-4E81-4673-B04B-E3B8A25CBE76@elde.net>
In-Reply-To: <569159E6.1040206@FreeBSD.org>
References:  <569159E6.1040206@FreeBSD.org>

next in thread | previous in thread | raw e-mail | index | archive | help

> On 09 Jan 2016, at 20:05, Lev Serebryakov <lev@FreeBSD.org> wrote:
>=20
> I have this:
>=20
> expire-after:356d AND 5G
>=20
> and now my /var/audit contains 1 year of files, but it takes 105
> gigabytes (!).
>=20
> It is FreeBSD 10.2-STABLE r286784

I don't recall how that limit is implemented, but it could be related to thi=
s:

https://www.freebsd.org/security/advisories/FreeBSD-EN-15:19.kqueue.asc

Terje




Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?89CCB3E8-4E81-4673-B04B-E3B8A25CBE76>