Does audit_control's "expire-after" by size works?

[Lev Serebryakov]

Hello Terje,

Saturday, January 9, 2016, 11:55:42 PM, you wrote:

>> expire-after:356d AND 5G
>> 
>> and now my /var/audit contains 1 year of files, but it takes 105
>> gigabytes (!).
>> 
>> It is FreeBSD 10.2-STABLE r286784

> I don't recall how that limit is implemented, but it could be related to this:
> https://www.freebsd.org/security/advisories/FreeBSD-EN-15:19.kqueue.asc
 All these files are less than 2G. Really, each individual file is less than
200M.

 And here are my other question (in separate message).


-- 
Best regards,
 Lev                            mailto:lev at FreeBSD.org
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Type: application/pgp-signature
Size: 960 bytes
Desc: not available
URL: <http://lists.freebsd.org/pipermail/freebsd-security/attachments/20160110/8668dad2/attachment.sig>