Hi,
On a heavy server it is filling up too quickly /var/asl/data/audit/ and I can have gigabytes of data and I see it not take empty after a while so in days I get 20-30GB. How can I cleanup? Is there a command in mod_sec or ASL ?
Cleanup of /var/asl/data/audit/
Cleanup of /var/asl/data/audit/
Best regards,
Valics Lehel
Power Toys for PLESK
HOW TO: Setup a new box with PLESK
PLESK Crash Recovery Service
Valics Lehel
Power Toys for PLESK
HOW TO: Setup a new box with PLESK
PLESK Crash Recovery Service
Re: Cleanup of /var/asl/data/audit/
Hmmm..although mine isn't big, the sheer number of files in there is causing a problem for me and I would certainly like to get control of this.
I thought this setting in /etc/asl/config might be related:
ASL_DB_RETENTION="5 days"
But it is not -- that's for the DB only from the looks of things (since I have 16 days worth in the audit directory, and given it has "DB" not "audit" in the variable name! ).
I thought this setting in /etc/asl/config might be related:
ASL_DB_RETENTION="5 days"
But it is not -- that's for the DB only from the looks of things (since I have 16 days worth in the audit directory, and given it has "DB" not "audit" in the variable name! ).
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
- mikeshinn
- Atomicorp Staff - Site Admin
- Posts: 4152
- Joined: Thu Feb 07, 2008 7:49 pm
- Location: Chantilly, VA
Re: Cleanup of /var/asl/data/audit/
This is the setting that controls how long the audit data is kept for WAF events:
https://www.atomicorp.com/wiki/index.ph ... LEAN_ALERT
https://www.atomicorp.com/wiki/index.ph ... LEAN_ALERT
Michael Shinn
Atomicorp - Security For Everyone
Atomicorp - Security For Everyone
Re: Cleanup of /var/asl/data/audit/
ooh, a new one on me. Thanks.
--------------------------------
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
<advert>
If you want to rent a UK-based VPS that comes with friendly advice and support from a fellow ART fan, please get in touch.
</advert>
Re: Cleanup of /var/asl/data/audit/
I really wish they would store this data in a database ... the number of files is eating up our inodes...