In this lab, we will take a look at setting up auditing services on a Red Hat host. We will configure low space email alerting, limit logging space used, and limit the number of audit buffers. The overall goal of this lab is to control the amount of space our audit logs are using and to use email alerting in order to prevent a partition from filling up.
*This course is not approved or sponsored by Red Hat.*
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Configure the auditd service to start automatically at boot
Run the following command to ensure
auditdstarts automatically at boot:systemctl enable auditd
- Setup low disk space email alerts
- Edit the
/etc/audit/auditd.conffile and set:space_left = 100space_left_action = email
- Edit the
- Restrict the disk space used by the audit logs
- Edit the
/etc/audit/auditd.conffile and set themax_log_fileand thenum_logsvalues so their multiplied value is equal to 300 MB.- Example:
max_log_filecould be set to "30" andnum_logscould be set to "10".
- Example:
- Save and exit the file.
- Edit the
- Limit the number of audit buffers used by the system
- Edit the file
/etc/audit/rules.d/audit.rulesand change the line showing-b 8192to-b 5120. Lastly, restart the
auditdserviceservice auditd restart
- Edit the file
