Linux Audit Framework Log Directory (/var/log/audit)

Bottom Line: It is safe to prune old rotated audit log files (audit.log.1, audit.log.2). The Linux auditd framework logs system calls, file permissions changes, and user authentication events.

Why Do Auditd Logs Exist?

Enterprise Linux security policies require tracking user authentication, file access modifications (/etc/passwd, /etc/shadow), and execution of setuid binaries.

• Primary Purpose: Compliance auditing (PCI-DSS, HIPAA, CIS Benchmarks) and post-incident security forensics.
• Storage Growth: High-activity enterprise servers write gigabytes of audit events, consuming 3 GB to 40 GB+.

What Happens If You Delete Old Auditd Logs?

• System Safety: ✅ Safe to Prune. Modern active audit logging is not interrupted.
• Compliance Note: Ensure logs are archived to a remote SIEM server before local deletion if subject to compliance audits.
• Reclaimed Storage: Frees 3 GB to 40 GB+ of server disk space.

How to Clean Auditd Logs

# Delete rotated audit log archives
sudo rm -f /var/log/audit/audit.log.[1-9]*

Frequently Asked Questions (FAQ)

How do I limit auditd disk usage in auditd.conf?

Edit /etc/audit/auditd.conf and set max_log_file = 50 (MB) and max_log_file_action = ROTATE.