Re: Stop/Disable AUDITD on RHEL7
On Thursday, August 3, 2017 5:12:39 PM EDT warron.french wrote:
I am running RHEL 7 Server so that I can also run Red Hat Satellite.
I seem to be having resource contention problems and auditd is a part of
the problem consuming up to 22.0% according to results of the *top* command.
I'd be curious what the flush technique is in auditd.conf.
I have:
1. executed a *systemctl disable auditd; systemctl stop auditd* (with
an error about dependencies)
"service auditd stop" is the correct way to stop auditd.
2. executed a *service auditd stop (*and the service stops but
doesn't
not remain stopped).
Do you have some systems management software that is sneaking in behind you
and modifying settings and starting it?
3. Rebooting the machine after the *systemctl disable auditd
*also
didn't have any effect.
It should. I don't know how else it could get re-enabled without some systems
management software also configuring it when you're not looking.
-Steve
I did set -e 1 in the audit.rules file so that I could stop the
auditd on
my demand, but the service restarts anyway.
Thanks for your help in advance.
--------------------------
Warron French