On Mar 12, 2018, at 11:16 AM, Todd Heberlein <todd_heberlein(a)mac.com&gt; wrote: I am using a Linux system (RHEL 6.9) with no audit rules set: $ sudo auditctl -l No rules but some data is still populating the audit log file /var/log/audit/audit.log Are there processes (or kernel code) that generate their own audit events that bypass the configured audit rules? Thanks, Todd -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

On Mon, 12 Mar 2018 11:55:32 -0700 Todd Heberlein <todd_heberlein(a)mac.com&gt; wrote: > Following the poor practice of replying to my own email :( > > Apparently most of the data in audit.log is associated with PAM > auditing. > > https://access.redhat.com/documentation/en-us/red_hat_enterprise_linux/6/... tps://www.redhat.com/mailman/listinfo/linux-audit There are hardwired events (events that show up no matter what the rules say) that come from things that are required. For example: logins, logouts, adding a user, deleting a user, changing a password, etc. These are usually documented in our STIG rules saying this requirement is met due to hardwired events.

-Steve