On Thursday, August 3, 2017 5:12:39 PM EDT warron.french wrote: > I am running RHEL 7 Server so that I can also run Red Hat Satellite. > > I seem to be having resource contention problems and auditd is a part of > the problem consuming up to 22.0% according to results of the *top* command.
I'd be curious what the flush technique is in auditd.conf. > I have: > > 1. executed a *systemctl disable auditd; systemctl stop auditd* (with > an error about dependencies) "service auditd stop" is the correct way to stop auditd. > 2. executed a *service auditd stop (*and the service stops but doesn't > not remain stopped). Do you have some systems management software that is sneaking in behind you and modifying settings and starting it? > 3. Rebooting the machine after the *systemctl disable auditd *also > didn't have any effect. It should. I don't know how else it could get re-enabled without some systems management software also configuring it when you're not looking. -Steve > I did set -e 1 in the audit.rules file so that I could stop the auditd on > my demand, but the service restarts anyway. > > > Thanks for your help in advance. > -------------------------- > Warron French -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit
