Re: kauditd is writing too many lines in syslog
On Mon, 20 Jan 2014 12:36:27 -0500
Richard Guy Briggs <rgb(a)redhat.com> wrote:
> Can I ask kauditd not print anything if user space program
cannot
> handle that much message?
Sure, on the kernel boot line you can set audit=0 to disable kaudit,
or you can tell the init system to not start auditd.
what if someone never wants events to go to syslog?
-Steve