kauditd is writing too many lines in syslog

Steve Grubb sgrubb at redhat.com
Mon Jan 20 17:40:55 UTC 2014


On Mon, 20 Jan 2014 12:36:27 -0500
Richard Guy Briggs <rgb at redhat.com> wrote:

> > Can I ask kauditd not print anything if user space program cannot
> > handle that much message?  
> 
> Sure, on the kernel boot line you can set audit=0 to disable kaudit,
> or you can tell the init system to not start auditd.

what if someone never wants events to go to syslog?

-Steve




More information about the Linux-audit mailing list