What Is AUDITD_DISABLE_CONTEXTS?

What Is AUDITD_DISABLE_CONTEXTS?

[Wyllie, Aaron]

[-- Attachment #1.1: Type: text/plain, Size: 1128 bytes --]

Sorry if this is a novice question, but in trying to gather up as much information on auditd I came across the Suse SLED 10/11 audit guides.

They reference setting a line in /etc/sysconfig/auditd to "auditd_disable_contexts=0".  That line doesn't exist in my default /etc/sysconfig/auditd file on RHEL5.

I saw a past mailing list thread from Dec. 11 2006 where Steve said it didn't exist...so I'm a little confused.  Is this a SLED-thing only?  Was it ever part of the default auditd?  Is it safe to ignore this?  If it can be ignored, what functionality superseded it or delivered the same results in the first place?

Thanks in advance.

Aaron

________________________________
The information contained in this message is proprietary and/or confidential. If you are not the intended recipient, please: (i) delete the message and all copies; (ii) do not disclose, distribute or use the message in any manner; and (iii) notify the sender immediately. In addition, please be aware that any message addressed to our domain is subject to archiving and review by persons other than the intended recipient. Thank you.

[-- Attachment #1.2: Type: text/html, Size: 3406 bytes --]

[-- Attachment #2: Type: text/plain, Size: 0 bytes --]

Re: What Is AUDITD_DISABLE_CONTEXTS?

[Steve Grubb]

On Tuesday 08 December 2009 09:38:30 am Wyllie, Aaron wrote:
> Is this a SLED-thing only?

Doesn't ring a bell, so I guess so.

> Was it ever part of the default auditd?  

Nope.

> Is it safe to ignore this?

On a RHEL machine, yes.

> If it can be ignored, what functionality superseded
>  it or delivered the same results in the first place?

No idea what it was.

-Steve