On Wednesday 20 May 2009 02:37:01 pm LC Bruzenak wrote: > How can I tell when the rotate is complete so I can move the files out?
Use ls -i /var/log/audit/audit.log and watch for the inode to change. Read it first, rotate, and then read again. If you don't see progress after a certain amount of time, you might want to check syslog for problems. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
