Re: "write_logs = no" not working

I will leave the real debugging to the experts. but a possible workaround until then would be to set: num_logs = 2 max_log_file = 1 max_log_file_action = rotate This will use a max of 3MB for three 1MB local files, which will be rotated. Not zero, but a very minimal amount of local storage used. On Sun, Mar 5, 2017 at 10:24 PM Ian Pilcher <arequipeno(a)gmail.com&gt; wrote: (Apologies if this is a duplicate. gmane doesn't seem to be working.) I have a Banana Pi-based firewall system, which runs off a micro-SD card and sends all of its logs (including audit events) to a syslog server. I have set "write_logs = no" in /etc/audit/auditd.conf, but the local log file is still being written. (Commenting out the log_file line causes auditd to abort.) What do I need to do to disable writing the local file? (This is audit 2.6.5 on CentOS 7.) -- ======================================================================== Ian Pilcher arequipeno(a)gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ======================================================================== -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit