On Fri, 2007-08-03 at 13:54 -0500, Timothy R. Chavez wrote: > On Fri, 2007-08-03 at 13:26 -0500, Ameel Kamboh wrote: > > I notice that if the auditd service is not running, > > I see all my audit logs go out on the console, > > When I start auditd service they go to the appropriate log file. > > Is there a way to turn this off in the kernel? > > > > Hi Ameel, > > If audit is enabled, but auditd isn't running, the audit records will be > delivered to userspace via printk (KERN_NOTICE <5>). So perhaps you'll > just need to edit /etc/sysconfig and route kern.5 accordingly? If you
Erm, /etc/syslog.conf -tim -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
