Re: Completely disable audit.log, only pass logs through dispatcher
I asked this same question a couple of months ago.
https://www.redhat.com/archives/linux-audit/2013-October/msg00083.html
On Wed, Dec 25 2013 at 03:21, Aaron Lewis wrote:
Hi,
is it possible to completely disable audit log?
I use a dispatcher to handle everything and doens't want anything on disk.
(And I don't care for a trivial data loss)
I tried to set the log to /dev/null, but auditd doesn't accept that