Question about Linux Redhat OS audit logs. Is anyone familiar with the audit.log.xxx and the audit.log.xxx.gz relation? I've been moving the logs in /var/log/audit off for retention but I think I might be doing it incorrectly by moving the gz files off to be backed up and also to make room on /var/log/audit volume. Does someone know which logs are OK to move off and which ones should be left alone? So the /var/log/audit volume does not fill up. Last week the /var/log/audit volume filled up. I've relocated audit logs in the 200 and 300 range to a larger partition but they are being recreated in the /var/log/audit folder. Here's a sample of what my /var/log/audit folder looks like. audit.log audit.log.1 audit.log.10

...

audit.log.199

audit.log.1.gz

audit.log.2

...

audit.log.299

audit.log.2.gz

audit.log.3

...

and so on    



Software/Hardware used:
Redhat RHEL 5