diff -urp audit-2.3.5.orig/src/auditd-event.c audit-2.3.5/src/auditd-event.c --- audit-2.3.5.orig/src/auditd-event.c 2014-03-11 13:45:06.000000000 -0400 +++ audit-2.3.5/src/auditd-event.c 2014-03-11 15:23:10.971506011 -0400 @@ -705,7 +705,8 @@ static void rotate_logs(struct auditd_co unsigned int len, i; char *oldname, *newname; - if (data->config->num_logs < 2) + if (data->config->max_log_size_action == SZ_ROTATE && + data->config->num_logs < 2) return; /* Close audit file. fchmod and fchown errors are not fatal because we