Re: Is audit really disabled?
On Wed, 10 Aug 2005, Steve Grubb wrote:
On Wednesday 10 August 2005 16:25, James Morris wrote:
> kauditd is running and I appear to be getting some audit messages on the
> console.
What messages are you getting? You will get SE Linux messages. Also, there is
a bug that I found where user space originating messages were not getting
checked to see if auditing is enabled. They were relayed unconditionally. I
think David rolled it up into a patch that includes file system auditing -
hence its never gotten upstream.
Yes, I think they are login messages.
Why is kauditd still running?
- James
--
James Morris
<jmorris(a)redhat.com>