audit_warn5

Overview

The audit_warn script runs when auditd(8) generates warning messages.

The default audit_warn is a script whose first parameter is the type of warning; the script appends its arguments to /etc/security/audit_messages. Administrators may replace this script: a more comprehensive one would take different actions based on the type of warning. For example, a low-space warning could result in an email message being sent to the administrator.

Files

/etc/security/audit_warn

/etc/security/audit_messages