Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Broadcast a warning if a system halt is possible #435

Merged
merged 3 commits into from
Feb 26, 2025

Conversation

Cropi
Copy link
Contributor

@Cropi Cropi commented Feb 10, 2025

The space left action no longer supports HALT. If we reach this stage, ensure that all logged-in users are notified in case admin_space_left_action or disk_space_full_action is set to halt the system.

The space left action no longer supports HALT. If we reach this
stage, ensure that all logged-in users are notified in case a
system halt is possible.
@stevegrubb
Copy link
Contributor

OK, I think I'm on board with this. (Was considering if we should make a new target F_HALT_WALL that includes this broadcast while the original does not.) The only thing is the message should say something to the effect of "The audit system is low on disk space and is now halting the system for admin corrective action." It currently tells the why, but not what's about to happen.

@Cropi
Copy link
Contributor Author

Cropi commented Feb 25, 2025

Actually, that information is already included in the next_actions string.

  1. When the space_left threshold is reached, audit will warn about the HALT option configured in either admin_space_left_action or disk_full_action.
  2. When the admin_space_left threshold is reached, audit will warn about the HALT option in disk_full_action.

@stevegrubb
Copy link
Contributor

So, it's going to output: "Broadcast message from audit daemon: The audit system is low on disk space for logging. If the disk becomes full, audit will halt." I feel like it's better to be more direct that it's going down now.

@Cropi
Copy link
Contributor Author

Cropi commented Feb 26, 2025

I adjusted the message but there is a reason I did not want to say that explicitly. Since space_left_action no longer includes HALT, corrective actions might intervene, and stating that we're going down could be misleading.

@stevegrubb
Copy link
Contributor

Thanks!

@stevegrubb stevegrubb merged commit 5a329ce into linux-audit:master Feb 26, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants