Audit.log in linux capturing SAS audit

[sathya66]

All,

Audit.log in Linux is capturing the SAS details. is it by default or do we need to configure it somewhere?

Audit log is filling up very fast after patching that is causing server crash.Log rotation in place but not working after patching.

type=PROCTITLE msg=audit(1604652864.918:12790651): proctitle=706F7374677265733A20737461747320636F6C6C6563746F722070726F63657373202020
type=SYSCALL msg=audit(1604652864.918:12790652): arch=c000003e syscall=82 success=yes exit=0 a0=7ffd250bd920 a1=7ffd250bd520 a2=1a7a720 a3=1 items=5 ppid=26975 pid=26982 auid=1334035802 uid=103 gid=101 euid=103 suid=103 fsuid=103 egid=101 sgid=101 fsgid=101 tty=(none) ses=8 comm="postgres" exe="/sas/home/SASWebInfrastructurePlatformDataServer/9.4/bin/postgres" subj=unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023 key="delete"
type=CWD msg=audit(1604652864.918:12790652): cwd="/SAS/config/Lev2/WebInfrastructurePlatformDataServer/data"
type=PATH msg=audit(1604652864.918:12790652): item=0 name="pg_stat_tmp/" inode=1575695 dev=ca:a0 mode=040700 ouid=103 ogid=101 rdev=00:00 obj=unconfined_u:object_r:unlabeled_t:s0 objtype=PARENT cap_fp=0000000000000000 cap_fi=0000000000000000 cap_fe=0 cap_fver=0

[AnandVyas]

Hi @sathya66 

I don't think its enabled by default. You can check the audit rules under /etc/audit/audit.rules or /etc/audit/rules.d/audit.rules file.