Re: Clear kernel audit buffer?
On Tuesday, January 14, 2014 01:09:52 PM Aaron Lewis wrote:
Yes, I did run auditctl -D to clear all rules. And during testing I
have enlarged the buffer queue to 10240 messages.
Did you mean that once -D is issued, the buffer will be cleared by
auditd, but not by linux kernel?
There is no way to directly clear the in kernel buffer. The audit system is
supposed to keep events for disposition. If there was a simple command to dump
events, that would be a simple way to circumvent detection. So, the best way
to drain the queues is to give auditd more priority so it runs more often and
longer before its time slice is up. You don't need to log to disk. But
something has to read the events to get them out.
-Steve