FW: I'd like to turn auditd off but...

[Steve Grubb]

On Thursday, November 24, 2011 08:28:49 PM Brian Ross wrote:
> Further to this, I've just found out that auditd is logging it seems every
> transaction that Oracle makes.   I have found squillions of entries in the
> log file for the oracle user "orpmpxgi".  Is there any way to quickly stop
> auditd logging for a particular user?

If you are on RHEL4 or later, you can do something like this near the top of your 
rules:

-a never,exit -F uid=orpmpxgi

But that means you also won't get security relevant events either.

-Steve