How to tell if auditd has suspended logging?

Looking at the source code (in version 2.6.7), there is no way to retrieve the current "suspended" state other than attaching a debugger to the process and make it dump the value of the logging_suspended internal variable.

You could send a test message and check that it gets logged though. That way, you'd check for the suspended condition but also for anything that prevents logging from happening. That is, you'd validate that it works properly all the way through.

msg="audit test $(uuidgen)" || exit # generate unique message
auditctl -m "$msg" || exit # send the unique message
sleep 1 # enough time for the message to be logged
ausearch -ts recent -m USER | grep -Fqe "$msg" && echo OK

Tags:

Logging

Auditd