On Sunday, October 27, 2013 09:10:50 PM Peter Moody wrote: > Is there anyway to run auditd without any local logging? I'm trying to > see if I can get auditd to completely avoid logging locally, using only > a custom dispatcher to log events remotely but auditd refuses to start > if I set log_file = '/dev/null'. log_format = NOLOG -Steve