I asked this same question a couple of months ago. https://www.redhat.com/archives/linux-audit/2013-October/msg00083.html
On Wed, Dec 25 2013 at 03:21, Aaron Lewis wrote: > Hi, > > is it possible to completely disable audit log? > > I use a dispatcher to handle everything and doens't want anything on disk. > (And I don't care for a trivial data loss) > > I tried to set the log to /dev/null, but auditd doesn't accept that -- Linux-audit mailing list [email protected] https://www.redhat.com/mailman/listinfo/linux-audit
