auditd "admin_space_left_action" EXEC <script> does not execute.
Posted: 2021/04/19 17:04:51
I'm need help to configure auditd to execute a script to shutdown the Apache service once the daemon detects that the disk is below the configured "admin_space_left" value.
** /etc/audit/auditd.conf **
...
space_left = 100
space_left_action = email
admin_space_left = 50
admin_space_left_action = EXEC /opt/startup/scripts/audit_log_action.sh
disk_full_action = EXEC /opt/startup/scripts/audit_log_action.sh
...
*********
** /opt/startup/scripts/audit_log_action.sh **
#!/bin/bash
# APSC-DV-001120
# Stops apache when there is low disk space or an error in logging
logger -s "System is low on disk space - stopping Apache httpd service"
/sbin/apachectl stop
**********
I've used 'fallocate' to create files that fill the volume so that only 38M is free but auditd doesn't execute the script to stop the Apache service.
** /etc/audit/auditd.conf **
...
space_left = 100
space_left_action = email
admin_space_left = 50
admin_space_left_action = EXEC /opt/startup/scripts/audit_log_action.sh
disk_full_action = EXEC /opt/startup/scripts/audit_log_action.sh
...
*********
** /opt/startup/scripts/audit_log_action.sh **
#!/bin/bash
# APSC-DV-001120
# Stops apache when there is low disk space or an error in logging
logger -s "System is low on disk space - stopping Apache httpd service"
/sbin/apachectl stop
**********
I've used 'fallocate' to create files that fill the volume so that only 38M is free but auditd doesn't execute the script to stop the Apache service.