The /var/log/audit/audit.log files were not being rotated. The files in the directory grew so large that it created disk space issues on /. Here’s the fix. In the /etc/audit/auditd.conf file, change max_log_file_action from “ignore” to “rotate.” Instead of hundreds of files being kept, it will be rotated up to 5 files.
max_log_file_action = rotate
num_logs = 5 |
Restart service to take effect. The old files will be deleted.
service auditd stop service auditd start service auditd status |
Disk space went from 82% down to 25%.