Fedora

Question: How to delete the files which are older than n days WITHOUT use find command? For some reason, the find command is not used to check which files are older than n days, as a substitute, 'tmpwatch' can be used The syntax is: # tmpwatch [time in hours] [directory] For example, to delete files under /root/testdir/ not accessed for last 45 days ( 24x45 = 1018 hours), run the following command: # tmpwatch 1080 /root/testdir/ You could also specify the atime/mtime/ctime etc, to … [Read more...] about How to Delete the Files Which are Older Than n Days WITHOUT Using find Command

Monitoring The multipath command can be used to monitor the status of multipaths. When used with one -l option, it will show a quick overview of multipath topologies. If the -l option is specified twice (-ll), it will also perform a check on all paths to see if it is active. If everything is fine, a path will be reported as active ready. The output of multipath -ll provides information on each discovered multipath device. This is comprised of three sections. The sections provide information … [Read more...] about How to monitor the status of dm-multipathing and multipath devices (path groups) in Linux

What is multipathing? Multipathing allows the combination of multiple physical connections between a server and a storage array into one virtual device. This can be done to provide a more resilient connection to your storage (a path going down will not hamper connectivity), or to aggregate storage bandwidth for improved performance. As an example, the server in the following diagram has two HBAs, each connected to a separate Fibre Channel switch, which in turn are connected to separate … [Read more...] about Understanding Linux multipath (dm-multipath)

Question: How to configure auditd to change the default permissions on the /var/log/audit/audit.log from 0600 to 0640 and also changing the group ownership of the file? By default it's not possible to change permissions on the /var/log/audit/audit.log file using ACLs, instead "log_group" parameter can be set under the file /etc/audit/audit.conf. The Steps In this example, we would like to change default permissions on the /var/audit/audit.log from 600 to 640 and also changing group from … [Read more...] about How to change the default permissions on /var/log/audit/audit.log file in CentOS/RHEL

Question: A file seems to be disappearing and no direct reason for its disappearance can be found. How can we monitor the file access, especially the deletion of a particular file in CentOS/RHEL system? A file can be monitored through its lifecycle by using the Linux auditd service. The Steps 1. To install it on CentOS or RHEL, run: # yum install audit 2. To enable the service at boot time, run: # chkconfig auditd on # For CentOS/RHEL 6 # systemctl enable auditd # For … [Read more...] about A File Is Claimed to Be Disappearing – How to monitor a file for deletion in Linux

This post explains how to stop audit log entries written to system logs. 1. Check the file /etc/audisp/plugins.d/syslog.conf. By default, the file "/etc/audisp/plugins.d/syslog.conf will have the below line. args = LOG_INFO This will allow syslog to log audit logs into /var/log/messages. In addition audit.d will log all the audit events to /var/log/audit/audit.log too and this is the data normally we use to check audit events. 2. Duplicating the entries in /var/log/messages is not … [Read more...] about How to Stop Audit Log Entries Written to System Logs in CentOS/RHEL 6

This post explains how to free up space when files under /var/cache/yum is filling up the disk space. This is normal behavior as the cache would increase its size based on the frequency of syncing with the yum server. Its an administrative task provide adequate space. This should be corrected by either running: # yum clean all The above command cleans all cached files from any enabled repository. It is useful to run this from time to time to make sure there is nothing using unnecessary … [Read more...] about /var/cache/yum Constantly Filling Files System in CentOS/RHEL