Red Hat Enterprise Linux 5 Administration Unleashed

Writing Audit Rules and Watches 509admin_space_left_actionAction to take when the amount of free disk space reaches admin_space_left.Valid values are IGNORE, SYSLOG, EMAIL, SUSPEND, SINGLE, and HALT. The actionsassociated with these values are the same as the ones from space_left_action.disk_full_actionTake this action if the partition containing the audit log file becomes full.Possible values are IGNORE, SYSLOG, SUSPEND, SINGLE, and HALT. The actions associatedwith these values are the same as the ones from space_left_action.TIPIf the audit log files are not rotated, the partition containing the /var/log/audit/ canbecome full and cause system errors. Thus, it is recommended that /var/log/audit/be a separate dedicated partition.disk_error_actionAction to take if an error is detected while writing audit logs or rotating the auditlog files. The value must be one of IGNORE, SYSLOG, SUSPEND, SINGLE, and HALT.The actions associated with these values are the same as the ones fromspace_left_action.25The /etc/sysconfig/auditd file can be used to set command-line options for auditd withthe EXTRAOPTIONS parameter. The only command line option, -f, puts the daemon indebugging mode. If debugging mode is enabled, messages go to standard error instead ofthe log file. The AUDITD_LANG setting can be used to change the locale for the daemon. Ifset to none, all locale information is removed from the audit environment. If theAUDITD_CLEAN_STOP option is set to yes, audit rules and watches are deleted when theaudit daemon is stopped with the service auditd stop command. For more informationon audit rules, refer to the next section.Writing Audit Rules and WatchesThe Linux Auditing System can be used to write rules for events such as system calls andto watch operations on files or directories using the auditctl command-line utility. If theinitialization script is used to start auditd (using the service auditd start command),the rules and watches can be added to /etc/audit/audit.rules so they are executedwhen the daemon is started. Only the root user can read or modify this file.Each rule and watch in /etc/audit/audit.rules must be on its own line, with linesbeginning with # being ignored. The rules and watches are the auditctl command-lineoptions without the auditctl command preceding them. They are read from the top ofthe file to the bottom. If one or more rules or watches conflict with each other, the firstone found is used.