Audit messages on console

Ameel Kamboh akamboh at nortel.com
Fri Aug 3 18:26:18 UTC 2007


I notice that if the auditd service is not running,
I see all my audit logs go out on the console,
When I start auditd service they go to the appropriate log file.
Is there a way to turn this off in the kernel?

Below is my auditd.conf file:

log_file = /var/log/audit/audit.log
log_format = RAW
priority_boost = 3
flush = INCREMENTAL
freq = 20
num_logs = 10
max_log_file = 50
max_log_file_action = ROTATE
space_left = 750
space_left_action = SYSLOG
action_mail_acct = root
admin_space_left = 250
admin_space_left_action = SYSLOG
disk_full_action = SYSLOG
dispatcher = /usr/sbin/SnareDispatcher /sbin/auditspd

Ameel Kamboh
SIP Core Network and Security 
Phone: 972.685.4922 (esn 445-4922)
Mobile: 978-590-2280
SIP: akamboh at techtrial.com
email: akamboh at nortel.com



-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20070803/78964271/attachment.htm>


More information about the Linux-audit mailing list