[sudo-users] maxseq after the fact

[Todd C. Miller]

On Fri, 19 May 2017 11:04:29 -0500, Leroy Tennison wrote:

> I have been using log_output with maxseq=400 for some time but failed to impl
> ement maxseq on one device (discovered it due to disk space used). I added 'm
> axseq=400' to /etc/sudoers on that device but /var/log/sudo-io/00/00 now has 
> 600+ directories. Will adding maxseq "auto magically" clean up the situation 
> or do I have to do something manually? If it's the latter, what do I need to 
> do? Thanks for the help. 

You will need to remove the other directories manually.  For a
maxseq of 400 sudo will create directories from /var/log/sudo-io/00/00/01
to /var/log/sudo-io/00/00/B4.

You could clean this via:

# rm -rf /var/log/sudo-io/0[1-9A-Z] /var/log/sudo-io/00/0[1-9A-Z] 	 /var/log/sudo-io/00/00/B[5-9A-Z] /var/log/sudo-io/00/00/[C-Z]*

But I suggest do you:

# ls -1d /var/log/sudo-io/0[1-9A-Z] /var/log/sudo-io/00/0[1-9A-Z] 	 /var/log/sudo-io/00/00/B[5-9A-Z] /var/log/sudo-io/00/00/[C-Z]*

first to make sure you are not going to remove anything unexpected.

 - todd