A company has activated auditing on all of their systems. The default destination directory for the audit trail is /var/audit on each system. In the past few weeks, they had problems with one of the systems acting as a print server. A user sent a large print job, which caused /var on the print server to become full. As a result, auditing was no longer working. They changed the /etc/security/audit_control file to include a second destination directory (using the dir: keyword). When will the audit subsystem switch from the first directory to the second configured directory?

A.
after 24 hours

B.
when the first directory is full

C.
depends on the configuration of /etc/logadm.conf

D.
when the first directory has less than minfree percent free

E.
auditd will use both directories in round-robin and switch after writing a complete audit event record.