Re: FW: I'd like to turn auditd off but...
On Monday, November 28, 2011 01:37:23 PM Worsham, Michael wrote:
If you have figured out a way to exclude logging via a User or UID,
please
post it. Our Oracle OEM and VMware Tools daemons just spit out so much
information it's unreal.
What kinds of events are we talking about? (assuming oracle is uid orpmpxgi):
ausearch --start today --uid orpmpxgi --raw | aureport --summary --event -i
-Steve