I notice that if the auditd service is not running, I see all my audit logs go out on the console, When I start auditd service they go to the appropriate log file. Is there a way to turn this off in the kernel? Below is my auditd.conf file: log_file = /var/log/audit/audit.log log_format = RAW priority_boost = 3 flush = INCREMENTAL freq = 20 num_logs = 10 max_log_file = 50 max_log_file_action = ROTATE space_left = 750 space_left_action = SYSLOG action_mail_acct = root admin_space_left = 250 admin_space_left_action = SYSLOG disk_full_action = SYSLOG dispatcher = /usr/sbin/SnareDispatcher /sbin/auditspd Ameel Kamboh SIP Core Network and Security Phone: 972.685.4922 (esn 445-4922) Mobile: 978-590-2280 SIP: akamboh(a)techtrial.com email: akamboh(a)nortel.com