Re: I'd like to turn auditd off but...
On 21 November 2011 18:04, Brian Ross <Brian.Ross(a)asggroup.com.au> wrote:
I have a client who is still running RHEL3. Over the last 12 months
the
auditd process has become steadily more and more intrusive and causing
problems. I have attempted to turn it off but whenever I do so, suddenly
SSH logins stop working.
At the moment the only way I have to manage the auditd process is to
regularly delete the 2+GB of log files it creates every 4 hours. Can
anybody tell me how to turn it off without affecting other things?
I would say that your user has other problems that need to be addressed
before you can turn off audit.
1) Audit doesn't have anything to do with sshd that I can remember in
RHEL-3. So if one is turning off the other.. then I would start looking at
compromised system.
2) 2GB every 4 hours means there is something really wrong. Again I would
say its either compromised system or hardware issue.
--
Stephen J Smoogen.
"The core skill of innovators is error recovery, not failure avoidance."
Randy Nelson, President of Pixar University.
"Let us be kind, one to another, for most of us are fighting a hard
battle." -- Ian MacLaren
Attachments:
- attachment.html (text/html — 1.7 KB)