Tested on Rocky Linux 10
sed -i 's/max_log_file_action =.*/max_log_file_action = rotate/' /etc/audit/auditd.conf
sed -i 's/max_log_file =.*/max_log_file = 30/' /etc/audit/auditd.conf
pkill -9 -f /sbin/auditd
ps -ef | grep -i auditd
systemctl start auditd.service
systemctl status auditd.service
ls -la /var/log/audit/
less behave like tail -fless +F somelogfile
cat /dev/null > logfile
echo -n > logfile
> logfile #bash
find /var/log -follow -type f -mmin -1
tail -f /storage/log/vmware/applmgmt/monsvc.log | egrep --color=always -i '$|error|crit|warn'
lsof | egrep 'log$|out$' | awk '{print $10}' | sort -u | xargs tail -f | egrep --color=always -i '$|error|crit|warn'
lsof /var/log /storage/log | awk '{print $9}' | sort -u | xargs tail -f | tee /tmp/all.log
journalctl -af
/etc/rsyslog.d/mydomain.conf
#auth,authpriv.* @syslog.mydomain.ch:1516
:msg, contains, "pam_unix(cron:session)" ~
:msg, contains, ": uid: missing" ~
*.* @syslog.mydomain.ch:1516
script -a -f $HOME/console.log