Alert for Audit log

Linux and Unix-Like SuSE
1

Dear users,

I have SLES 11 and SLES 10 servers.

I'd like to receive an alert when audit log files reach certain percentage of full.

  1. Is '/etc/audit/auditd.conf' the right file to modify?

  2. I'd like to receive email alert. Can I specify my email in this parameter 'action_mail_acct = jpark@comp.xxxx.xxx'?

  3. I'd like to get notified when the log file reaches 90%. What parameter value should I change? And where is it?

Thank you,

2
Moderator comments were removed during original forum migration.