[auditd] improve log size limiting

Signed-off-by: Bryn M. Reeves <bmr@redhat.com>

1 files changed, 13 insertions, 6 deletions

diff --git a/sos/plugins/auditd.py b/sos/plugins/auditd.py
index 1f513062..1f9c7c4d 100644
--- a/sos/plugins/auditd.py
+++ b/sos/plugins/auditd.py
@@ -18,15 +18,22 @@ class Auditd(Plugin, RedHatPlugin, DebianPlugin, UbuntuPlugin):
     """Auditd related information
     """
 
-    option_list = [("logsize", "maximum size (MiB) of logs to collect",
-                    "", 15)]
+    option_list = [("logsize", "maximum size (MiB) of logs to collect", "", 15),
+                   ("all_logs", "collect all logs regardless of size", "", False)]
 
     plugin_name = 'auditd'
 
+    packages = ('audit',)
+
     def setup(self):
-        self.add_copy_specs(["/etc/audit/auditd.conf",
-                            "/etc/audit/audit.rules"])
-        self.add_copy_spec_limit("/var/log/audit*",
-                sizelimit = self.get_option("logsize"))
+        self.add_copy_specs([
+            "/etc/audit/auditd.conf",
+            "/etc/audit/audit.rules"
+        ])
+        if not self.get_option("all_logs"):
+            limit = self.get_option("logsize")
+            self.add_copy_spec_limit("/var/log/audit/audit.log", sizelimit=limit)
+        else:
+            self.add_copy_spec("/var/log/audit")
 
 # vim: et ts=4 sw=4