On Sunday, September 14, 2014 09:47:12 PM Laurent Bigonville wrote: > Yesterday, I apparently run out of diskspace. Today I was wondering why > there was no new audit trails in the logs. > > systemctl status auditd showed me: > > Audit daemon is low on disk space for logging > Audit daemon is suspending logging due to low disk space. > > Shouldn't the daemon resume the logging when free disk space is > available again?
Its never done that. You need to send SIGUSR2 to auditd to get it to wake up. Normally this is done with "service auditd resume". -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
