[Date Prev][Date Next] [Chronological] [Thread] [Top]

Re: Q: using logrotate for auditlog file



Hi Michael,
obviously it depends on your use case.
For example, if you make use of tools like Splunk you don't have to worry of the file itself at all.
And are you sure that a slapo-auditlog write is not atomic? I have not had a look at the source code but I think it would make sense... Just speculating, of course.

Bye
Marco


On Wed, Jul 16, 2014 at 8:29 PM, Michael StrÃder <michael@stroeder.com> wrote:
Marco Pizzoli wrote:
> yes but leveraging the "copytruncate" option of logrotate. So you don't
> have to worry about the open state of the file.

Truncating in the middle of a LDIF record would be a bad idea...

Ciao, Michael.