Is there anyway to run auditd without any local logging? I'm trying to see if I can get auditd to completely avoid logging locally, using only a custom dispatcher to log events remotely but auditd refuses to start if I set log_file = '/dev/null'.
Cheers, peter -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
