On Thursday, November 24, 2011 08:28:49 PM Brian Ross wrote: > Further to this, I've just found out that auditd is logging it seems every > transaction that Oracle makes. I have found squillions of entries in the > log file for the oracle user "orpmpxgi". Is there any way to quickly stop > auditd logging for a particular user?
If you are on RHEL4 or later, you can do something like this near the top of your rules: -a never,exit -F uid=orpmpxgi But that means you also won't get security relevant events either. -Steve -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
