Re: [PATCH] audit: set context->dummy even when audit is off
On 11/1/19 9:49 AM, Steve Grubb wrote:
> +1 for me, except I would also question why it would even listen,
as to
> me it seems that implies storage.
>
> If that's true, I would want to be able to disable it as I do not want
> audit events stored elsewhere as well.
It is true. You get 2 copies, one in the journal and it also relays one to
rsyslog. This should fix it:
systemctl mask systemd-journald-audit.socket
-Steve
Gotcha; thanks Steve.
LCB
--
Lenny Bruzenak
MagitekLTD
Attachments:
- attachment.html (text/html — 1011 bytes)