Further to this, I’ve just found out that auditd is logging it
seems every transaction that Oracle makes. I have found squillions of entries
in the log file for the oracle user “orpmpxgi”. Is there any way to quickly
stop auditd logging for a particular user?
Stopping that, may fix many of my problems.
Cheers
Brian Ross
From:
linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On
Behalf Of Brian Ross
Sent: Tuesday, November 22, 2011 9:04 AM
To:
Subject: I'd like to turn auditd off but...
I
have a client who is still running RHEL3. Over the last 12 months the
auditd process has become steadily more and more intrusive and causing
problems. I have attempted to turn it off but whenever I do so,
suddenly SSH logins stop working.
At
the moment the only way I have to manage the auditd process is to regularly
delete the 2+GB of log files it creates every 4 hours. Can anybody
tell me how to turn it off without affecting other things?
Cheers
Brian
Ross
Brian Ross
Technical Consultant
ASG Group Limited
Level 1 / 267 St Georges Tce.
Perth, WA, 6000
Telephone
+61 8 9420 5451
Mobile +61
0434 181 701
Facsimile
+61 8 9420 5422
Confidentiality Notice: The information contained in this
message is strictly confidential. It is intended only for the use of the
individual or entity named above. If the reader is not the intended recipient,
or the authorised agent thereof, you are hereby notified that any disclosure,
use, distribution or copying of the within information is strictly prohibited.
If you have received this message in error, please notify us immediately by
telephone and delete all copies of the original message.
P PLEASE
CONSIDER THE ENVIRONMENT BEFORE YOU PRINT THIS E-MAIL