The Tool Desk
Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →An audit archive can retain files for 24 months yet still miss most of the events from many days. In a September 2026 account, אחיה כהן reported that one Ubuntu server’s archive contained only 234 of the most recent 696 hours—about a third—because the local auditd log ring could cycle out records before the nightly archive job collected them. Retention duration and completeness are different things: what matters is how long logs remain locally available compared with the time between archive pickups.
How a 24-month archive can miss most of a day
The archive job in כהן’s account ran nightly after forcing log rotation. The servers used auditd 3.1.2 on Ubuntu 24.04, with 22–25 audit rules each. Locally, the described ring consisted of five 8 MB files, with max_log_file_action = ROTATE. As the ring cycled, older files could be removed before the next nightly pickup.
As an Amazon Associate I earn from qualifying purchases.
That creates a gap between two clocks: how quickly audit events fill the local ring, and how frequently the archiver collects rotated files. A long-term archive can preserve everything it receives while still omitting records that disappeared locally before pickup.
Ubuntu’s auditd.conf documentation describes the relevant controls: max_log_file sets the size threshold, max_log_file_action defines the response at that threshold, and num_logs specifies how many rotated files are kept when the action is rotate. These settings govern local rotation and retention; they do not by themselves prove that an archive contains every interval.
#1 Best Overall
- Easily store and access 2TB to content on the go with the Seagate Portable Drive, a USB external hard drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
What the reported measurements show—and do not show
Across 29 days, כהן reported the following mean daily archive coverage for four servers. These are measurements from that account, not independently verified results or a representative rate for other systems.
| Server | Reported mean daily archive coverage |
|---|---|
| Database | 33.6% |
| Website | 52.6% |
| Voice | 75.0% |
| Chatwoot | 94.0% |
The database example makes the practical consequence concrete: the author said the archive held 234 of the most recent 696 hours. On that server, 35,082 of 35,659 rule-matching events were attributed to postgres. The account traced heavy event volume to broad file watches and frequent writes, including activity under a watched database directory and rsync deployment activity. A rule set that is manageable on one host can generate a very different log volume on another.
Rank #2
- Easily store and access 5TB of content on the go with the Seagate portable drive, a USB external hard Drive
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
The post also reports 19,177 SYSCALL events in audit.log and 18,912 in auth.log for a specified overnight interval. It says the syslog plugin forwarded records into auth.log, but also describes forwarding loss and journald rate limiting. Treat that file as an additional record source to assess, not as a guaranteed lossless backup.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsMeasure the pickup gap on your own servers
Do not infer completeness from the archive’s oldest date or its nominal retention period. Check how much local history remains on the busiest host and compare that span with the actual time between successful archive pickups. Include weekends, delayed jobs, outages, and unusually busy periods in the check.
Rank #3
- Easily store and access 1TB to content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop. Reformatting may be required for Mac
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
כהן’s account proposes inferring intervals from each archived file’s first record timestamp and its modification time. That approach assumes the file is not touched after creation; later writes or metadata updates can undermine the inference. Validate the method against your log lifecycle and inspect records directly where possible.
The author’s test is a useful warning, not a universal coverage formula. Event rate and bursts vary by workload, audit rules, and server. A snapshot of quiet hours cannot establish what happens during a deployment or database write surge.
Rank #4
- Easily store and access 4TB of content on the go with the Seagate Portable Drive, a USB external hard drive.Specific uses: Personal
- Designed to work with Windows or Mac computers, this external hard drive makes backup a snap just drag and drop
- To get set up, connect the portable hard drive to a computer for automatic recognition no software required
- This USB drive provides plug and play simplicity with the included 18 inch USB 3.0 cable
- The available storage capacity may vary.
Choose a rotation and pickup strategy that matches the workload
| Approach | What it controls | Operational consideration |
|---|---|---|
Size-based rotation with rotate |
Rotates when the configured size threshold is reached; num_logs limits the rotated files retained locally. |
Pickup timing must be short enough that the ring does not cycle past unarchived files. |
keep_logs |
Rotates without applying the num_logs limit. |
Files accumulate, so disk capacity and behavior when space runs low need explicit planning. |
| Time-based rotation | Rotates according to a schedule rather than relying only on reaching a size threshold. | It changes the rotation trigger, but does not alone guarantee that an archive job collects every file before local retention removes it. |
Ubuntu’s auditd.conf(5) describes keep_logs as similar to rotate but without the num_logs limit. More retained files require more disk capacity; administrators still need to plan for disk-space handling and the configured disk-full response. Ubuntu’s auditd.cron documentation describes a time-based rotation approach as an alternative to the default size-based approach. Examples are package- and version-specific, so check the documentation installed on the target host before adopting a configuration.
Recommended Free Tools
Shorten the gap, then test burst behavior
In the reported setup, כהן added a locked quarter-hourly job to archive files already rotated by size, while keeping a nightly forced rotation. This reduced the pickup gap in that environment, but the author still identified a burst risk: more than roughly 32 MB of log data in 15 minutes could outpace the available ring. That figure belongs to the described setup; it is not a safe universal threshold.
Best Value
- [Upgraded Version] - This external hard drive features a mirrored logo stripe combined with a striped anti-slip design, and the rounded corners of the casing make it easier to grip. The stripes also have a heat dissipation function, ensuring stable and fast data transfer.
- 【Ultra-thin and quiet】 - The motherboard adopts JMicron 578 noise-free solution, giving you a quiet working environment. Lightweight and portable size designed to fit in your pocket for easy portability.
- 【Ultra-Fast Data Transfers】 - Pairing this external hard drive with JMicron 578 solution USB 3.0 and USB 2.0 interfaces enables blazing-fast data transfer. It boasts theoretical read speeds of up to 125MB/s and write speeds of up to 103MB/s.
- 【Plug and Play】 - With no software to install, just plug it in and the drive is ready to use.The hard disk chip is wrapped with an aluminum anti-interference layer to increase heat dissipation and protect data.
- 【What You Get】 - 1 x Portable Hard Drive, 1 x USB 3.0 Cable, 1 x User Manual, Gift-type shell packaging ,Three-year manufacturer's warranty and free technical support services.
Ubuntu documents that sending SIGUSR1 causes auditd to rotate logs immediately, with the result governed by max_log_file_action. See auditd(8) and confirm behavior against the installed version before using it in an operational procedure. Rotation on demand is useful only if the rotated files are then archived and verified before the local ring can discard them.
- Estimate the local ring’s usable history on the busiest server, not just its configured file count.
- Compare that history with the longest real interval between successful pickups.
- Check whether high-volume rules watch frequently changing directories or deployment activity, and tune rules only where doing so remains consistent with the audit requirements.
- Monitor free disk space and the disk-full action, especially if using
keep_logs. - Check the archive for missing time intervals after job failures and during high-volume bursts; a successful job exit is not proof of complete coverage.
Retention claims need a completeness check
כהן says the archive was intended to meet a 24-month retention requirement under Israeli data security regulations. The account does not identify the regulation or establish which entities, logs, or circumstances it covers, so that statement should not be treated as general legal guidance. Whatever retention obligation applies to a particular system, storing records for the required duration and collecting all relevant records are separate operational questions.
The author’s practical test is blunt: “If the second command shows fewer hours than the gap between your archive runs, your retention policy exists only in a document.” The useful question for an administrator is equally direct: how many hours does the local ring actually hold on the busiest server, and is that more than the longest gap before pickup?
Free tools Windows power users keep installed
One-click scans. No signup required.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
