Novell LINUX ENTERPRISE DESKTOP 11 - SECURITY GUIDE 17-03-2009 Manual page 356

action_mail_acct
Specify an e-mail address or alias to which any alert messages should be sent. The
default setting is root, but you can enter any local or remote account as long as
e-mail and the network are properly configured on your system and /usr/lib/
sendmail exists.
admin_space_left and admin_space_left_action
admin_space_left takes a numerical value in megabytes of remaining disk
space. The system is already running low on disk space when this limit is reached
and the administrator has one last chance to react to this alert and free disk space
for the audit logs. The value of admin_space_left should be lower than the
value for space_left. The values for admin_space_left_action are the
same as for space_left_action.
NOTE: CAPP Environment
Set admin_space_left to a value that would just allow the administra-
tor's actions to be recorded. The action should be set to single.
disk_full_action
Specify which action to take when the system runs out of disk space for the audit
logs. The possible values are the same as for space_left_action.
NOTE: CAPP Environment
As the disk_full_action is triggered when there is absolutely no more
room for any audit logs, you should bring the system down to single-user
mode (single) or shut it down completely (halt).
disk_error_action
Specify which action to take when the audit daemon encounters any kind of disk
error while writing the logs to disk or rotating the logs. The possible value are the
same as for space_left_action.
NOTE: CAPP Environment
Use syslog, single, or halt depending on your site's policies regarding
the handling of any kind of hardware failure.
344 Security Guide