Audit messages on console & in logwatch

[Steve Grubb]

On Thursday 30 June 2005 07:51, David D. Hagood wrote:
> These also show up in /var/log/messages, and are thus picked up by
> logwatch.

You can disable auditing, but you won't get complete SE Linux avc denial 
information. This is done with audit=0 boot param, or auditctl -e 0. 

The alternative is to install the audit package which will pick up these 
messages and deposit them in /var/log/audit/audit.log. This keeps them out 
of /var/log/messages.

-Steve