Re: FW: I'd like to turn auditd off but...
On Thursday, November 24, 2011 08:28:49 PM Brian Ross wrote:
Further to this, I've just found out that auditd is logging it
seems every
transaction that Oracle makes. I have found squillions of entries in the
log file for the oracle user "orpmpxgi". Is there any way to quickly stop
auditd logging for a particular user?
If you are on RHEL4 or later, you can do something like this near the top of your
rules:
-a never,exit -F uid=orpmpxgi
But that means you also won't get security relevant events either.
-Steve