Re: Audit messages on console

On Fri, 2007-08-03 at 13:26 -0500, Ameel Kamboh wrote: > I notice that if the auditd service is not running, > I see all my audit logs go out on the console, > When I start auditd service they go to the appropriate log file. > Is there a way to turn this off in the kernel? > Hi Ameel, If audit is enabled, but auditd isn't running, the audit records will be delivered to userspace via printk (KERN_NOTICE <5>). So perhaps you'll just need to edit /etc/sysconfig and route kern.5 accordingly? If you