Subject:
The QuantaStor keeps a set of audit logs that track any administrative changes made to the QuantaStor system.
This log is periodically rotated and the time and duration of the rotation can be modified if needed.
Detail:
The main audit log for QuantaStor administrative changes is available under "/var/log/qs_audit.log".
This log can be copied from the system at any time without effecting the system operation.
The log is rotated periodically using a system cron job but rotation and the values can be modified by editing our "logrotate" rules under the "/var/opt/osnexus/quantastor/qs_logrotate.conf" file.
Example:
The logrotate definition shown below will give you 90 days worth of logs by changing the number of weeks that will be kept to "13:
/var/opt/osnexus/quantastor/qs_logrotate.conf
/var/log/qs_service.log {
rotate 13
size 25M
copytruncate
weekly
missingok
compress
delaycompress
}
The qs_audit.log is rotated weekly every 5 weeks, in the below file:
/var/opt/osnexus/quantastor/qs_audit_logrotate.conf
You could make the below changes to increase the retention to be 13 weeks:
/var/log/qs_audit.log {
rotate 13
copytruncate
size 4096k
weekly
compress
delaycompress
}
Note: Both the "qs_logrotate.conf" and "qs_audit_logrotate.conf" logs should be changed and any changes you make to the logrotate configuration will take effect when it is next run.
Additional information can be found at this link:
QuantaStor_Troubleshooting_Guide#Audit_Logging
Comments