I'm using 7.x with latest update :-(<div id="yMail_cursorElementTracker_1602699047480"><br></div><div id="yMail_cursorElementTracker_1602699047656">Can i reopen the bug?</div><div id="yMail_cursorElementTracker_1602699086627"><br></div><div id="yMail_cursorElementTracker_1602699109520">( I turned off selinux for the auditd to work the halt )</div><div id="yMail_cursorElementTracker_1602699101704"><br></div><div id="yMail_cursorElementTracker_1602699086800">Best Regards,</div><div id="yMail_cursorElementTracker_1602699096073">Fabio Sbano<br><br><div id="ymail_android_signature"><a id="ymail_android_signature_link" href="https://go.onelink.me/107872968?pid=InProduct&c=Global_Internal_YGrowth_AndroidEmailSig__AndroidUsers&af_wl=ym&af_sub1=Internal&af_sub2=Global_YGrowth&af_sub3=EmailSignature">Sent from Yahoo Mail on Android</a></div> <br> <blockquote style="margin: 0 0 20px 0;"> <div style="font-family:Roboto, sans-serif; color:#6D00F6;"> <div>On Wed, Oct 14, 2020 at 2:12 PM, Steve Grubb</div><div><sgrubb@redhat.com> wrote:</div> </div> <div style="padding: 10px 0 0 20px; margin: 10px 0 0 0; border-left: 1px solid #6D00F6;"> Hello,<br clear="none"><br clear="none">On Wednesday, October 14, 2020 12:51:44 PM EDT Fabio Sbano wrote:<br clear="none">> My /etc/audit/auditd.conf is configured as below but it is not turning off<br clear="none">> the system<br clear="none">> <br clear="none">> ## This file controls the configuration of the audit daemon#<br clear="none">> local_events = yeswrite_logs = yeslog_file =<br clear="none">> /var/log/audit/audit.loglog_group = rootlog_format = RAWflush =<br clear="none">> INCREMENTAL_ASYNCfreq = 50max_log_file = 8num_logs = 5priority_boost =<br clear="none">> 4disp_qos = lossydispatcher = /sbin/audispdname_format = NONE##name =<br clear="none">> mydomainmax_log_file_action = ROTATEspace_left = 75space_left_action =<br clear="none">> SYSLOGverify_email = yesaction_mail_acct = rootadmin_space_left =<br clear="none">> 50admin_space_left_action = haltdisk_full_action =<br clear="none">> SUSPENDdisk_error_action = SUSPENDuse_libwrap = yes##tcp_listen_port =<br clear="none">> 60tcp_listen_queue = 5tcp_max_per_addr = 1##tcp_client_ports =<br clear="none">> 1024-65535tcp_client_max_idle = 0enable_krb5 = nokrb5_principal =<br clear="none">> auditd##krb5_key_file = /etc/audit/audit.keydistribute_network = no<br clear="none"> <br clear="none">I believe this bz is relevant:<br clear="none"><a shape="rect" href="https://bugzilla.redhat.com/show_bug.cgi?id=1780332" target="_blank">https://bugzilla.redhat.com/show_bug.cgi?id=1780332</a><br clear="none"><br clear="none">If you update to the 7.9 release, it should work like it is supposed to.<div class="yqt6548723862" id="yqtfd27656"><br clear="none"><br clear="none">Best Regards,</div><br clear="none">-Steve<div class="yqt6548723862" id="yqtfd85026"><br clear="none"><br clear="none"><br clear="none"></div> </div> </blockquote></div>