Re: Stop/Disable AUDITD on RHEL7

[Steve Grubb <sgrubb@redhat.com>]

On Thursday, August 3, 2017 5:12:39 PM EDT warron.french wrote:
> I am running RHEL 7 Server so that I can also run Red Hat Satellite.
> 
> I seem to be having resource contention problems and auditd is a part of
> the problem consuming up to 22.0% according to results of the *top* command.

I'd be curious what the flush technique is in auditd.conf.

> I have:
> 
>    1. executed a *systemctl disable auditd; systemctl stop auditd*  (with
>    an error about dependencies)

"service auditd stop" is the correct way to stop auditd.

>    2. executed a *service auditd stop (*and the service stops but doesn't
>    not remain stopped).

Do you have some systems management software that is sneaking in behind you 
and modifying settings and starting it?

>    3. Rebooting the machine after the *systemctl disable auditd *also
>    didn't have any effect.

It should. I don't know how else it could get re-enabled without some systems 
management software also configuring it when you're not looking.

-Steve
 
> I did set -e 1 in the audit.rules file so that I could stop the auditd on
> my demand, but the service restarts anyway.
> 
> 
> Thanks for your help in advance.
> --------------------------
> Warron French