Identifying storage for audit logging

The default configuration of Control Center audit logging requires 10GB of storage in /var/log/serviced on the master host. Use this procedure to determine whether sufficient space is available.
  1. Log in to the master host as root, or as a user with superuser privileges.
  2. Display the amount of space available in /var/log.
    The /var/log/serviced directory does not exist until Control Center is upgraded.
    df -h /var/log
    Typically, /var/log is mounted on the root filesystem, /.
  3. Display the amount of space available in /tmp.
    Docker requires 10GB of storage for temporary files, and the Control Center Installation Guide includes instructions to link the Docker temporary directory to /tmp.
    df -h /tmp
    Like /var/log, /tmp is typically mounted on the root filesystem, /.
If /var/log and /tmp each have 10GB of available storage, for a combined total of 20GB, then the master host has sufficient space for audit logging. Otherwise, you must choose one of the following alternatives:
  • After upgrading Control Center, mount the serviced audit log directory on a larger local or remote file system, modify the settings in the /opt/serviced/etc/logrotate.conf configuration file.
  • Use a cron job to copy the files to a larger local or remote file system.
  • Forward the log files to a log management application.