SELinux Audit Log Files (/var/log/audit/audit.log)

Bottom Line: It is safe to rotate and prune old SELinux audit logs. SELinux logs permission denials (AVC messages) into /var/log/audit/audit.log.

Why Do SELinux Audit Logs Exist?

Security-Enhanced Linux (SELinux) enforces mandatory access control policies on RHEL, CentOS, AlmaLinux, and Fedora servers. When an application attempts an unpermitted syscall or port bind, SELinux logs an AVC (Access Vector Cache) audit record.

• Primary Purpose: Logging security policy denials and system call security events.
• Storage Growth: Misconfigured services or mislabeled files can trigger continuous denial logging, growing logs to 2 GB to 30 GB+.

What Happens If You Delete SELinux Audit Logs?

• System Safety: ✅ Safe to Rotate. Active SELinux security enforcement policy remains 100% active.
• Logrotate Management: Using logrotate compresses old audit.log files cleanly.
• Reclaimed Storage: Frees 2 GB to 30 GB+ of server disk space.

How to Rotate SELinux Audit Logs

# Force auditd log rotation
sudo service auditd rotate

Frequently Asked Questions (FAQ)

Why is my audit.log filling up the root partition?

If a background service (e.g. custom Nginx build) accesses restricted ports, SELinux logs AVC denials continuously. Use sealert -a /var/log/audit/audit.log to generate fix rules.