A server administrator notices the /var/log/audit/audit.log file on a Linux server is rotating too frequently. The administrator would like to decrease the number of times the log rotates without…

Question

Options

• AIncrease the audit.log file size in the appropriate configuration file.
• BDecrease the duration of the log rotate cycle for the audit.log file.
• CRemove the log rotate directive from the audit.log file configuration.
• DMove the audit.log files to a remote syslog server.

• A
  68% (15)
• B
  5% (1)
• C
  9% (2)
• D
  18% (4)

Explanation

The audit.log rotates when it reaches the configured maximum file size. If it is rotating too frequently, the file size limit is too small and the log fills up quickly. Increasing the maximum file size in the auditd configuration file (/etc/audit/auditd.conf, specifically the 'max_log_file' parameter) allows more data to accumulate before rotation occurs, reducing rotation frequency without losing any log data. Option B (decreasing the rotate cycle duration) would make rotation happen MORE frequently. Option C (removing the rotate directive) could cause the log to grow indefinitely and fill the filesystem. Option D (moving logs to a remote syslog) does not reduce local rotation frequency.

No community discussion yet for this question.