Is audit really disabled?

[James Morris]

On Wed, 10 Aug 2005, Steve Grubb wrote:

> On Wednesday 10 August 2005 16:25, James Morris wrote:
> > kauditd is running and I appear to be getting some audit messages on the
> > console.
> 
> What messages are you getting? You will get SE Linux messages. Also, there is 
> a bug that I found where user space originating messages were not getting 
> checked to see if auditing is enabled. They were relayed unconditionally. I 
> think David rolled it up into a patch that includes file system auditing - 
> hence its never gotten upstream.

Yes, I think they are login messages.

Why is kauditd still running?



- James
-- 
James Morris
<jmorris at redhat.com>