From 67abafa20c646d40acf135ead266e7eb00226d39 Mon Sep 17 00:00:00 2001 From: "Bryn M. Reeves" Date: Fri, 20 Jun 2014 17:20:18 +0100 Subject: [auditd] improve log size limiting Signed-off-by: Bryn M. Reeves --- sos/plugins/auditd.py | 19 +++++++++++++------ 1 file changed, 13 insertions(+), 6 deletions(-) diff --git a/sos/plugins/auditd.py b/sos/plugins/auditd.py index 1f513062..1f9c7c4d 100644 --- a/sos/plugins/auditd.py +++ b/sos/plugins/auditd.py @@ -18,15 +18,22 @@ class Auditd(Plugin, RedHatPlugin, DebianPlugin, UbuntuPlugin): """Auditd related information """ - option_list = [("logsize", "maximum size (MiB) of logs to collect", - "", 15)] + option_list = [("logsize", "maximum size (MiB) of logs to collect", "", 15), + ("all_logs", "collect all logs regardless of size", "", False)] plugin_name = 'auditd' + packages = ('audit',) + def setup(self): - self.add_copy_specs(["/etc/audit/auditd.conf", - "/etc/audit/audit.rules"]) - self.add_copy_spec_limit("/var/log/audit*", - sizelimit = self.get_option("logsize")) + self.add_copy_specs([ + "/etc/audit/auditd.conf", + "/etc/audit/audit.rules" + ]) + if not self.get_option("all_logs"): + limit = self.get_option("logsize") + self.add_copy_spec_limit("/var/log/audit/audit.log", sizelimit=limit) + else: + self.add_copy_spec("/var/log/audit") # vim: et ts=4 sw=4 -- cgit