auditd without a logfile?
Is there anyway to run auditd without any local logging? I'm trying to
see if I can get auditd to completely avoid logging locally, using only
a custom dispatcher to log events remotely but auditd refuses to start
if I set log_file = '/dev/null'.
Cheers,
peter