Auditd Fills Up Var Partition

/Var Partition filled

Red Hat Enterprise Linux 3 contains the auditd package, which logs many things in its own format. For some reason it never rotates these logs, which mean that they can grow to overfill the /var filesystem.

These files are stored in /var/log/audit.d and can be deleted at any time.

The longer term fix is to turn off audit.d completely:

# chkconfig auditd off
# service auditd stop

Note that due to dependancies you cannot remove the auditd package. Bummer.

This note is known valid for:

• RHEL 3 WS U4