Novell LINUX ENTERPRISE DESKTOP 11, Руководство пользователя

Страница: 396 / 450

NOTE: CAPP Environment
In a CAPP environment, make sure that the audit trail is always fully up to
date and complete. Therefore, use
sync
or
data
with the
flush
param-
eter.
num_logs
Specify the number of log files to keep if you have given
rotate
as the
max_log_file_action
. Possible values range from
0
to
99
. A value less than
2
means that the log files are not rotated at all. As you increase the number of files
to rotate, you increase the amount of work required of the audit daemon. While
doing this rotation, auditd cannot always service new data that is arriving from the
kernel as quickly, which can result in a backlog condition (triggering auditd to react
according to the failure flag, described in
Section 30.3, “Controlling the Audit
System Using auditctl” (page 385)). In this situation, increasing the backlog limit
is recommended. Do so by changing the value of the
-b
parameter in the
/etc/
audit/audit.rules
file.
disp_qos
and
dispatcher
The dispatcher is started by the audit daemon during its start. The audit daemon
relays the audit messages to the application specified in
dispatcher
. This appli-
cation must be a highly trusted one, because it needs to run as
root
.
disp_qos
determines whether you allow for
lossy
or
lossless
communication between
the audit daemon and the dispatcher. If you choose
lossy
, the audit daemon might
discard some audit messages when the message queue is full. These events still get
written to disk if
log_format
is set to
raw
, but they might not get through to
the dispatcher. If you choose
lossless
the audit logging to disk is blocked until
there is an empty spot in the message queue. The default value is
lossy
.
name_format
and
name
name_format
controls how computer names are resolved. Possible values are
none
(no name will be used),
hostname
(value returned by gethostname),
fqd
(full qualified hostname as received per DNS lookup),
numeric
(IP address) and
user
.
user
is a custom string that has to be defined with the
name
parameter.
max_log_file
and
max_log_file_action
max_log_file
takes a numerical value that specifies the maximum file size in
megabytes the log file can reach before a configurable action is triggered. The action
382 Security Guide