Short version: How to disable audit messages (dmesg) on a Fedora system?
A Fedora system keeps logging "audit: success" messages in dmesg - in such an extreme way that dmesg has become unusable because it's filled up by these messages (
dmesg | grep -v audit is empty). These messages are completely useless as they obviously want to inform the user that some every-day internal process has succeeded (which might be of interest when debugging something, but it's just noise in this case).
Even the command line interface (when switching to a non-X tty with Ctrl + Alt + F2) has become unusable as it's always cluttered with these audit messages, it's impossible to read the output of the commands that are actually run by the user. For example, after entering the username (login), an audit message is spewed out (apparently telling the user that something was formatted/printed successfully):
audit: type=1131 audit(1446913801.945:10129): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=fprintd comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
It appears that most of these messages indicate "success", however there are also many audit messages which do not contain this keyword. Running Chromium triggers hundreds of these:
audit: type=1326 audit(1446932349.568:10307): auid=500 uid=500 gid=500 ses=2 pid=1593 comm="chrome" exe="/usr/lib64/chromium/chrome" sig=0 arch=c000003e syscall=273 compat=0 ip=0x7f9a1d0a34f4 code=0x50000
Other messages include:
audit: type=1131 audit(1446934361.948:10327): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='unit=NetworkManager-dispatcher comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
audit: type=1103 audit(1446926401.821:10253): pid=28148 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred grantors=p am_env,pam_unix acct="user" exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
Generally, the majority of recent audit messages (at the time of writing) contains the keyword "NetworkManager" or "chrome".
How can these messages be disabled completely?
- In case anyone might be thinking "you should read and analyze these audit messages, not disable them, they could be important", no they are not important, they're almost exclusively "success" messages. Nobody needs to be told that something which is supposed to work did in fact work. However, if one actually significant message was being logged, it would never be noticed in the storm of thousands of insignificant messages. In any case, no audit logging is wanted on this particular system (it's running in a controlled environment anyway).
- Clearly, something must be very misconfigured on this system. However, it was once a default Fedora installation which has been upgraded whenever a new release came out. Maybe it's just a simple setting that has to be changed, but as it did not happen changing the system configuration manually (on purpose), this stackexchange.com question will hopefully help others who happen to have gotten their system in the same state.
- It's now a Fedora 22 system, running Linux 4.0.6 (systemd 219).
- It's a standard Fedora desktop installation, currently running KDE.
- SELinux is disabled (/etc/selinux/config is set to "disabled").
Update: After upgrading to Fedora 23 (kernel 4.2.5, systemd 222), there are fewer audit messages than before.