I use audit to log suspicious user actions on a workstation in my institution. I found that, in addition to logging to /var/log/audit.log, auditd also writes to /var/log/messages. Consequently, unprivileged user can view the logged record simply by typing the dmesg command. This greatly affects user privacy.

I've tried this and this, but instead of completely removing audit, I want it to still log to /var/log/audit.log.

I've also tried this: writing :programname, isequal, "audit" ~ to rsyslog.conf, but it did not work for me.

Some also suggest adding audit=0 to kernel parameter. I'm not sure if it shall disable auditd completely. Furthermore, the workstations have many active users and should not be rebooted.

Anyone have a clue?

Thanks in advance!

OS: Debian Testing auditctl version: 2.4.5


Logging to /var/log/messages does happen at the same time as /var/log/messages. audit=0 will disable all audit logs period. That shouldn't stop auditing period though. Consider using auditctl -e 0 also.

The audit logs that show up aren't really a "privacy concern", because if a user really wanted to know what's going on, they'd need ausearch and other au* commands to view the content of the logs/reports as they come up (hint, they need root). The audit logs will show the executed command among other things, but nothing beyond that (switches, other files, etc).

As a side note, there's also the ps command. Any user can see what another user is running anyway.

  • Thanks for your answering ( : but auditctl -e 0 will disable everything – Yun-Chih Chen Jan 18 '16 at 13:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.