Re: RHEL7 audispd syslog journal question

On Tuesday, June 11, 2019 8:14:30 AM EDT Boyce, Kevin P [US] (AS) wrote: On RHEL 7, there is no systemd-journald-audit.socket. So, if you are wrapping events to syslog, then that is how it gets filled. In general, systems that hae the systemd-journald-audit.socket can just mask it to prevent that path. systemctl mask systemd-journald-audit.socket Might also want to limit log size: sed -i "/^#SystemMaxUse/s/#SystemMaxUse=/SystemMaxUse=200/" /etc/systemd/ journald.conf If you wanted to restore your system to something that resembles normal systems, then you can do something along these lines: ## Disable journald systemctl mask systemd-journald.service systemctl mask systemd-journald-dev-log.socket systemctl mask systemd-journald.socket systemctl mask systemd-journal-flush.service systemctl mask systemd-journal-catalog-update.service systemctl mask syslog.socket ## Enable rsyslog to handle logging sed -i "/SysSock.Use/s/off/on/" /etc/rsyslog.conf sed -i "/imjournal/s/module/#module/" /etc/rsyslog.conf sed -i "/StateFile/s/^/#/" /etc/rsyslog.conf sed -i "/imklog/s/#module/module/" /etc/rsyslog.conf I tested this on recent Fedora. So, there may be some differences between F29 and RHEL 7. But this should be enough that you can experiment to finish it off. After this, syslog is actually usable like it used to be. -Steve