I'm looking for a way to silence frequent messages attributed to crond in my audit.log files.
Here is a snippet of the messages i would like to filter:
type=USER_ACCT msg=audit(10/20/2009 16:10:01.608:10196) : user pid=30783 uid=root auid=unset msg='PAM: accounting acct=root : exe=/usr/sbin/crond (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_ACQ msg=audit(10/20/2009 16:10:01.608:10197) : user pid=30783 uid=root auid=unset msg='PAM: setcred acct=root : exe=/usr/sbin/crond (hostname=?, addr=?, terminal=cron res=success)'
type=USER_START msg=audit(10/20/2009 16:10:01.612:10199) : user pid=30783 uid=root auid=root msg='PAM: session open acct=root : exe=/usr/sbin/crond (hostname=?, addr=?, terminal=cron res=success)'
type=CRED_DISP msg=audit(10/20/2009 16:10:01.656:10200) : user pid=30783 uid=root auid=root msg='PAM: setcred acct=root : exe=/usr/sbin/crond (hostname=?, addr=?, terminal=cron res=success)'
type=USER_END msg=audit(10/20/2009 16:10:01.656:10201) : user pid=30783 uid=root auid=root msg='PAM: session close acct=root : exe=/usr/sbin/crond (hostname=?, addr=?, terminal=cron res=success)'
I literally get tens-of-thousands of these a day in my consolidated
audit.log (via audisp-remote). All five of these events get dumped
to the audit log every time crond is executed.
The reasoning
behind this is that some of my customers are under regulations that
dictate security logs such as these are responded to and classified
within a certain time frame. This is obviously a problem due to the
frequency of these messages.
I've looked over every associated PAM module and corresponding
options with no luck. I also picked through as many auditd man pages i
could find.
The only thing i was able to dig up was the ability to 'exclude' certain message types with an audit rule.
For example, I could exclude all USER_ACCT, CRED_ACQ, USER_START,
CRED_DISP, and USER_END message types, however, that would weaken the
overall security posture as some critical messages would get filtered.
Any help would be greatly appreciated.
Thanks!
-Nick