Re: Suppress or exclude messages from /var/log/audit.log via audit.rules

This is the audit.rules below. # First rule - delete all > -D > # Increase the buffers to survive stress events. > # Make this bigger for busy systems > -b 320 > # Feel free to add below this line. See auditctl man page > -a exit,always -F arch=b64 -F dir=/etc -F success=0 -S open -S truncate > -a exit,always -F arch=b64 -S open -F uid=10 > -a exit,always -F arch=b64 -S open -F auid>=500 -F perm=wa > -a exit,never -F arch=x86_64 -S all -F path=/root/mysql_status_check.sh > -a never,exit -F arch=b32 -S open -S openat -F exit=-ENOENT > -a never,exit -F arch=b64 -S open -S openat -F exit=-ENOENT > -w /etc/sudoers -p wa -k sudoers-change > -w /etc/ -p wa > -w /var/lib/mysql -p wa