Bug 510775

Summary: Yast Configuration of Linux Audit Framework does Not offer Disk Space Action Items
Product: [openSUSE] openSUSE 11.1 Reporter: Scott Couston <scott>
Component: YaST2Assignee: Gabriele Mohr <gs>
Status: RESOLVED FIXED QA Contact: Jiri Srain <jsrain>
Severity: Enhancement    
Priority: P5 - None CC: meissner, tonyj
Version: Final   
Target Milestone: ---   
Hardware: x86-64   
OS: openSUSE 11.1   
Whiteboard:
Found By: --- Services Priority:
Business Priority: Blocker: ---
Marketing QA Status: --- IT Deployment: ---

Description Scott Couston 2009-06-07 09:29:30 UTC 
User-Agent:       Mozilla/5.0 (X11; U; Linux x86_64; en-GB; rv:1.9.0.10) Gecko/2009042700 SUSE/3.0.10-1.1.1 Firefox/3.0.10

The third tab of Configuration of Linux Audit Framework is the Disk Space Action fields. 
The Action of SYSLOG does not offer an IP address nor does it offer a 
/var/log/nnnnn.txt as this field remains with the title of 'Path to script' and only permits this field to be unlocked when the action is EXEC. This field label should take the same associated with the action.
Example if the Action chosen is SYSLOG the Field Label should change to
IP or Path and permit an IP address or log path /var/log/nnnn
If the action field is SINGLE the field label should change to the chosen SINGLE Action.
If the action field is EMAIL the field label should change to Email Address as there needs to be more than just one email action for 2 instances other than send system mail to a single user.

The Action on Error or Disk Full section follows the same action field issues raised above.

The first Tab - Maximum File Size Action also suffers for the corresponding field name change and accept the chosen action type as above.

The Dispatcher Tab has the field communication, however after reading its help, the field values and not clear and having elected the daemon with the audit dispatcher where are the fields that determine disposal of this information...I think there needs to be yet another Action send to 'various above options of syslog, email or log files

Reproducible: Always

Steps to Reproduce:
1.Open Yast>Security and Users>Configuration Linux of Audit Framework (LAF)
2.
3.
Actual Results:  
It appears that this Yast Application appears to have not been completed or finalised.

Expected Results:  
It appears that this Yast Application appears to have not been completed or finalised.
Comment 1 Marcus Meissner 2009-06-07 09:53:25 UTC 
SYSLOG is logging using facilities and the syslogd, it does not write files directly.

assign to yast2 laf module maintainer
Comment 2 Gabriele Mohr 2009-06-10 09:50:16 UTC 
Disk Space:
Setting the 'Action' for 'Space Left on Disk' or 'Admin Space Left' to 'SYSLOG' means that warnings about low disk space on log partition will be written to /var/log/messages. I will add this information to the help text.
The 'Action Mail Account' is valid for 'Space Left on Disk' and 'Admin Space Left' and can be specified in field 'Action Mail Account'.
The behaviour of the fields 'Path to Script' is correct, because only in case of 'EXEC' it makes sense to enter a script.
Log File:
Same as above. 
For detailed information about the action settings (as well as dispatcher settings) see 'man auditd.conf'.