[PATCH] audit: set context->dummy even when audit is off
Lenny Bruzenak
lenny at magitekltd.com
Fri Nov 1 14:58:07 UTC 2019
On 11/1/19 9:49 AM, Steve Grubb wrote:
>> +1 for me, except I would also question why it would even listen, as to
>> me it seems that implies storage.
>>
>> If that's true, I would want to be able to disable it as I do not want
>> audit events stored elsewhere as well.
> It is true. You get 2 copies, one in the journal and it also relays one to
> rsyslog. This should fix it:
>
> systemctl mask systemd-journald-audit.socket
>
> -Steve
Gotcha; thanks Steve.
LCB
--
Lenny Bruzenak
MagitekLTD
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://listman.redhat.com/archives/linux-audit/attachments/20191101/6c81082e/attachment.htm>
More information about the Linux-audit
mailing list