The default action to take when the logs reach their maximum size is to rotate the log files, discarding the oldest one. To configure the action taken by 'auditd', add or correct the line in '/etc/audit/auditd.conf': 'max_log_file_action = ACTION' Possible values for [ignore/syslog/suspend/keep_logs] Automatically rotating logs (by setting this to 'rotate') minimizes the chances of the system unexpectedly running out of disk space by being overwhelmed with log data. However, for systems that must never discard log data, or which use external processes to transfer it and reclaim space, 'keep_logs' can be employed. oval:org.secpod.oval:def:31052 oval:org.secpod.oval:def:30329 SCAP Repo OVAL Definition 2015-11-13