3

auditd sending logs to /var/logs/messages we want to disable it. How to do that?

/etc/audisp/plugins.d/syslog.conf

i changee active = no but still sending lots to syslog

  • You can place filters in syslog at the worst situation. – Rui F Ribeiro Nov 19 '15 at 23:29
4

Edit /etc/audisp/plugins.d and change args = LOG_INFOto this: args = local6

Then edit /etc/rsyslog.conf and add local6 to the "some catch-all log files" block so it's like this:

*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none;\
        local6.none           -/var/log/messages

Also change the line args = in /etc/audisp/plugins.d to: args = LOG_LOCAL6

This was adapted from this post.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.