rsau/max_diskspace/per_day Value?

[Former Member]

Hi all,

If rsau/max_diskspace/per_day set the max space for the total log files generate in one day, then what happen to the auditing function if the total size of log files generate in one day is great than this parameter's value? Will system stop auditing in that particular day and re-auditing in next day?

why in some technical document recommend rsau/max_diskspace/per_day = 0 and rsau/max_diskspace/per_file = 0? or just don't care.

Thanks

Alvin

[Former Member]

The parameter rsau/max_diskspace/per_day specifies the maximum size of one or all security audit files per day. This can be used to specify a threshold that cannot be exceeded. This parameter replaces the parameter rsau\max_diskspace/local. Make sure you take dependencies of other parameters into account. If the parameter is set to zero, the system does not monitor the file size.

The parameter rsau/max_diskspace/per_file specifies the maximum size of a security audit file. This can be used to tailor the file size to the requirements of

an archiving program, if used. For example, you could restrict the size to 650 MB to be able to fit one file on one normal-sized CD during archiving. When this size is reached, a new file is started. The counter in the file name is increased by one.

This parameter rsau/max_diskspace/per_file must be greater than zero for the system to be able to create more than one audit file per day. In this case, the file names of the audit files change (see parameter FN_AUDIT)

Cheers,

-Sunil

[Former Member]

Hi Sunil,

Thanks for your valuable information!

You mention that the parameter rsau/max_diskspace/per_day will replace the parameter rsau\max_diskspace/local. Is that mean the parameter rsau\max_diskspace/local no long functioning, as if it have ever not been specified before? Or in other word, if I am going to define the value for the parameter rsau/max_diskspace/per_day, there is no need for me to define another value for the parameter rsau\max_diskspace/local, because it will be replaced by the first one any way???

And I am wondering that will the system restart auditing in <b>next day</b> if the auditing log files exceed the value defined in rsau/max_diskspace/per_day?

Thanks

Alvin