<div dir="ltr"><div>Sort of a followup question. I'm surprised adding "audit.none" to the "/var/log/messages" line of rsyslog.conf (RHEL 6) works. I didn't think audit was a full "facility" in whatever rsyslog looks at. Am I more confused than normal?</div><div><br></div><div>Thanks!</div><div><br></div><div>Leam</div><div><br></div></div><div class="gmail_extra"><br><div class="gmail_quote">On Tue, Oct 4, 2016 at 10:36 AM, Steve Grubb <span dir="ltr"><<a href="mailto:sgrubb@redhat.com" target="_blank">sgrubb@redhat.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex"><span>On Tuesday, October 4, 2016 10:10:31 AM EDT leam hall wrote:<br>
> For /etc/audisp/plugins.d/syslog.<wbr>conf, is "LOG_WARN" an accpeted arg, or<br>
> does it need to be "LOG_WARNING"?<br>
<br>
</span>LOG_WARNING.<br>
<br>
<a href="https://fedorahosted.org/audit/browser/trunk/audisp/audispd-builtins.c#L279" target="_blank" rel="noreferrer">https://fedorahosted.org/<wbr>audit/browser/trunk/audisp/<wbr>audispd-builtins.c#L279</a><br>
<span class="HOEnZb"><font color="#888888"><br>
-Steve<br>
</font></span></blockquote></div><br><br clear="all"><br>-- <br><div class="gmail_signature" data-smartmail="gmail_signature"><div><a href="http://leamhall.blogspot.com/" target="_blank">Mind on a Mission</a></div></div>
</div>