auditd sending logs to
/var/logs/messages we want to disable it. How to do that?
active = no but still sending lots to syslog
/etc/audisp/plugins.d and change
args = LOG_INFOto this:
args = local6
/etc/rsyslog.conf and add
local6 to the "some catch-all log files" block so it's like this:
*.=info;*.=notice;*.=warn;\ auth,authpriv.none;\ cron,daemon.none;\ mail,news.none;\ local6.none -/var/log/messages
Also change the line
args = in
args = LOG_LOCAL6
This was adapted from this post.