<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 3.2//EN">
<HTML>
<HEAD>
<META HTTP-EQUIV="Content-Type" CONTENT="text/html; charset=us-ascii">
<META NAME="Generator" CONTENT="MS Exchange Server version 6.5.7652.24">
<TITLE>Audit messages on console</TITLE>
</HEAD>
<BODY>
<!-- Converted from text/rtf format -->
<P><FONT SIZE=2 FACE="Arial">I notice that if the auditd service is not running,</FONT>
<BR><FONT SIZE=2 FACE="Arial">I see all my audit logs go out on the console,</FONT>
<BR><FONT SIZE=2 FACE="Arial">When I start auditd service they go to the appropriate log file.</FONT>
<BR><FONT SIZE=2 FACE="Arial">Is there a way to turn this off in the kernel?</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">Below is my auditd.conf file:</FONT>
</P>
<P><FONT SIZE=2 FACE="Arial">log_file = /var/log/audit/audit.log</FONT>
<BR><FONT SIZE=2 FACE="Arial">log_format = RAW</FONT>
<BR><FONT SIZE=2 FACE="Arial">priority_boost = 3</FONT>
<BR><FONT SIZE=2 FACE="Arial">flush = INCREMENTAL</FONT>
<BR><FONT SIZE=2 FACE="Arial">freq = 20</FONT>
<BR><FONT SIZE=2 FACE="Arial">num_logs = 10</FONT>
<BR><FONT SIZE=2 FACE="Arial">max_log_file = 50</FONT>
<BR><FONT SIZE=2 FACE="Arial">max_log_file_action = ROTATE</FONT>
<BR><FONT SIZE=2 FACE="Arial">space_left = 750</FONT>
<BR><FONT SIZE=2 FACE="Arial">space_left_action = SYSLOG</FONT>
<BR><FONT SIZE=2 FACE="Arial">action_mail_acct = root</FONT>
<BR><FONT SIZE=2 FACE="Arial">admin_space_left = 250</FONT>
<BR><FONT SIZE=2 FACE="Arial">admin_space_left_action = SYSLOG</FONT>
<BR><FONT SIZE=2 FACE="Arial">disk_full_action = SYSLOG</FONT>
<BR><FONT SIZE=2 FACE="Arial">dispatcher = /usr/sbin/SnareDispatcher /sbin/auditspd</FONT>
</P>
<P><B><I><SPAN LANG="ko"><FONT COLOR="#008080" FACE="Batang">Ameel Kamboh</FONT></SPAN></I></B>
<BR><I><SPAN LANG="en-us"><FONT COLOR="#800000" SIZE=2 FACE="Arial">SIP Core</FONT></SPAN></I><SPAN LANG="en-us"><FONT COLOR="#800000" SIZE=2 FACE="Arial"> Network and Security </FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">Phone</FONT><FONT SIZE=2 FACE="Arial">: 972.685.4922 (esn 445-4922)</FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">Mobile</FONT><FONT SIZE=2 FACE="Arial">: 978-590-2280</FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">SIP</FONT><FONT SIZE=2 FACE="Arial">: akamboh@techtrial.com</FONT></SPAN>
<BR><SPAN LANG="fr"><FONT COLOR="#FF0000" SIZE=2 FACE="Arial">email</FONT><FONT SIZE=2 FACE="Arial">: </FONT></SPAN><A HREF="mailto:akamboh@nortel.com"><SPAN LANG="fr"><U><FONT COLOR="#0000FF" SIZE=2 FACE="Arial">akamboh@nortel.com</FONT></U></SPAN></A><SPAN LANG="fr"></SPAN><SPAN LANG="en-us"></SPAN>
</P>
<BR>
<BR>
</BODY>
</HTML>