I have an instance of 389-Directory running 1.4.4 on CentOS, for which
we keep an audit log. We've established size-based log rotation.
To reduce the likelihood of the audit log being accidentally altered,
I'd like to mark it as 'append only', using 'chattr':
chattr +a audit.log
This works great, until rotation time. Since "rename" is not "append",
any effort to mv the file out of the way fails. Is there a
pre/post-rotation mechanism through which I could:
disable the append-only restriction
let the log rotation happen
re-enable append-only on the new log file
Do things because you should, not just because you can.
John Thurston 907-465-8591
Department of Administration
State of Alaska
Show replies by date