<html>
<head>
<meta http-equiv="Content-Type" content="text/html;
charset=windows-1252">
</head>
<body text="#000000" bgcolor="#FFFFFF">
<p>On 11/1/19 9:49 AM, Steve Grubb wrote:<br>
</p>
<blockquote type="cite" cite="mid:786313584.jd3umIO2dN@x2">
<blockquote type="cite" style="color: #000000;">
<pre class="moz-quote-pre" wrap="">+1 for me, except I would also question why it would even listen, as to
me it seems that implies storage.
If that's true, I would want to be able to disable it as I do not want
audit events stored elsewhere as well.
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">It is true. You get 2 copies, one in the journal and it also relays one to
rsyslog. This should fix it:
systemctl mask systemd-journald-audit.socket
-Steve
</pre>
</blockquote>
<pre class="moz-quote-pre" wrap="">Gotcha; thanks Steve.
LCB
</pre>
<pre class="moz-signature" cols="72">--
Lenny Bruzenak
MagitekLTD</pre>
</body>
</html>