4

auditd sending logs to /var/logs/messages we want to disable it. How to do that?

/etc/audisp/plugins.d/syslog.conf

i changee active = no but still sending lots to syslog

1
  • You can place filters in syslog at the worst situation. Nov 19, 2015 at 23:29

1 Answer 1

5

Edit /etc/audisp/plugins.d and change args = LOG_INFOto this: args = local6

Then edit /etc/rsyslog.conf and add local6 to the "some catch-all log files" block so it's like this:

*.=info;*.=notice;*.=warn;\
        auth,authpriv.none;\
        cron,daemon.none;\
        mail,news.none;\
        local6.none           -/var/log/messages

Also change the line args = in /etc/audisp/plugins.d to: args = LOG_LOCAL6

This was adapted from this post.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .