Date: Sun, 10 Jan 2016 01:39:31 +0300 From: Lev Serebryakov <lev@FreeBSD.org> To: Terje Elde <terje@elde.net> Cc: freebsd-security@freebsd.org Subject: Re: Does audit_control's "expire-after" by size works? Message-ID: <8610441270.20160110013923@serebryakov.spb.ru> In-Reply-To: <89CCB3E8-4E81-4673-B04B-E3B8A25CBE76@elde.net> References: <569159E6.1040206@FreeBSD.org> <89CCB3E8-4E81-4673-B04B-E3B8A25CBE76@elde.net>
next in thread | previous in thread | raw e-mail | index | archive | help
------------05205B05E1FA06B26 Content-Type: text/plain; charset=us-ascii Content-Transfer-Encoding: quoted-printable Hello Terje, Saturday, January 9, 2016, 11:55:42 PM, you wrote: >> expire-after:356d AND 5G >>=20 >> and now my /var/audit contains 1 year of files, but it takes 105 >> gigabytes (!). >>=20 >> It is FreeBSD 10.2-STABLE r286784 > I don't recall how that limit is implemented, but it could be related to = this: > https://www.freebsd.org/security/advisories/FreeBSD-EN-15:19.kqueue.asc All these files are less than 2G. Really, each individual file is less than 200M. And here are my other question (in separate message). --=20 Best regards, Lev mailto:lev@FreeBSD.org ------------05205B05E1FA06B26 Content-Type: application/pgp-signature -----BEGIN PGP MESSAGE----- Version: GnuPG v2.0.22 (MingW32) iQJ8BAEBCgBmBQJWkYwiXxSAAAAAAC4AKGlzc3Vlci1mcHJAbm90YXRpb25zLm9w ZW5wZ3AuZmlmdGhob3JzZW1hbi5uZXRGOTZEMUNBMEI1RjQzMThCNjc0QjMzMEFF QUIwM0M1OEJGREM0NzhGAAoJEOqwPFi/3EePJYsP/RNfWPHjEB+Rr4Po4MzeF7Qy uyw3nWCMNyIGwFcFENWCusZyQ/utmS6q64idirdl6b8cy4kgCgvda0km5GTIizB6 0tUjQqQj9eFPxtf4hbkLoA5RYrG0MJxb0tf/sYR3gh8+6jZs0CGuU7+8iltzuYPj ok6liaPcpGa6t1NJpDyrHHEYkx0eBvLNexSNKkIjodb/hey16KdS1TCratGPz0G+ IBAivQrcE5+nRM3DftaRB8XECsEJGDre3EAI4XnJ2lBy+woog/xQNc9gYuKOoY1M eudyjTophpUbaOHhWZcTOKA8E7rMfEalZIgVDPTgArQu+Dw5YHH1Pky0rmR/U8dJ J+OfEiM0tsWqXWBc9shKjbDmlYbnubNeHVo/1IWTPFES5aefbjuWCoYh5hCAzf3q C5sj5NfyuwG0cl8CiPUmOetUSGycjr061geyYtxgz8ROEF2Z8s1MIj5G4vrt+ZGb pYulfWAOPazhNIznbHgQeLilHs+t17KfLR+dK3KbFt8fsq3aNbmZczn8LIWJIt8o EW8gh5U7roTZ0icxBX8Uz9ZLWJUF4Wc7jDyd1L8ULDOeGxPu65Pc9PGiKinyBVpQ 80uXxYP84TEUS8KssN7KUX6vNnlbbFPYuJieZgiKQABkVH83eh11vKlBmOcPIo+5 GCNITIl4WD+Aj2RD/oGg =3s47 -----END PGP MESSAGE----- ------------05205B05E1FA06B26--
Want to link to this message? Use this URL: <https://mail-archive.FreeBSD.org/cgi/mid.cgi?8610441270.20160110013923>