Audit log file rotation
Suggest changes
PDFs
If StorageGRID is configured for Admin Nodes/local nodes or Admin Node and external syslog server, the audit logs files are saved to the Admin Node's /var/local/audit/export/ directory. The active audit log files are named audit.log.
|
Optionally, you can change the destination of audit logs and send audit information to an external syslog server. Local logs of audit records continue to be generated and stored when an external syslog server is configured. Refer to Configure audit messages and external syslog server. |
Once a day, the active audit.log file is saved, and a new audit.log file is started. The name of the saved file indicates when it was saved, in the format yyyy-mm-dd.txt. If more than one audit log is created in a single day, the file names use the date the file was saved, appended by a number, in the format yyyy-mm-dd.txt.n. For example, 2018-04-15.txt and 2018-04-15.txt.1 are the first and second log files created and saved on 15 April 2018.
After a day, the saved file is compressed and renamed, in the format yyyy-mm-dd.txt.gz, which preserves the original date. Over time, Admin Node storage allocated for audit logs is consumed. A script monitors the audit log space consumption and deletes log files as necessary to free space in the /var/local/audit/export/ directory. Audit logs are deleted based on the date they were created. The oldest logs are deleted first. You can monitor the script's actions in the following file: /var/local/log/manage-audit.log.
This example shows the active audit.log file, the previous day's file (2018-04-15.txt), and the compressed file for the prior day (2018-04-14.txt.gz).
audit.log 2018-04-15.txt 2018-04-14.txt.gz