0

I'm trying to find out whether it is possible to configure linux to keep 110 copies of the audit log files. The setting is under /etc/audit/auditd.conf num_logs = 99

From reading, I understand that the max number that can be set is only up till 99. But still I would like to find out whether there are any method to increase this number.

1 Answer 1

1

Yes. You could recompile your own version and adapt it to allow an increase. You could copy those log files or you could use the limit of 99 and increase the log file sizes.

The last option is probably what you should be considering because it will give you the least amount of trouble and you probably care for the content of those files rather than actually having 110 files.

If it's about having a backlog of X days have a look at this Redhat post titled How to implement audit log rotation with compression based on time instead of size .

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .