From mboxrd@z Thu Jan 1 00:00:00 1970 From: Brian Ross Subject: I'd like to turn auditd off but... Date: Tue, 22 Nov 2011 09:04:07 +0800 Message-ID: <6BE4AAFB10DD834E8F60D36312048EAA0191691E44EF@PDCPXMB003.asggroup.com.au> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="_004_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_" Return-path: Received: from mx1.redhat.com (ext-mx13.extmail.prod.ext.phx2.redhat.com [10.5.110.18]) by int-mx02.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id pAM14NTd014573 for ; Mon, 21 Nov 2011 20:04:23 -0500 Received: from cao018mcs.asggroup.com.au (Ns2.asggroup.com.au [203.176.101.3]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id pAM14CGf003230 for ; Mon, 21 Nov 2011 20:04:14 -0500 Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --_004_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_ Content-Type: multipart/alternative; boundary="_000_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_" --_000_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_ Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: quoted-printable I have a client who is still running RHEL3. Over the last 12 months the au= ditd process has become steadily more and more intrusive and causing proble= ms. I have attempted to turn it off but whenever I do so, suddenly SSH lo= gins stop working. At the moment the only way I have to manage the auditd process is to regula= rly delete the 2+GB of log files it creates every 4 hours. Can anybody te= ll me how to turn it off without affecting other things? Cheers Brian Ross Brian Ross Technical Consultant ASG Group Limited Level 1 / 267 St Georges Tce. Perth, WA, 6000 Telephone +61 8 9420 5451 Mobile +61 0434 181 701 Facsimile +61 8 9420 5422 Brian.Ross@asggroup.com.au http://www.asggroup.com.au/ [cid:image001.gif@01CBB23E.C8A47A50] Confidentiality Notice: The information contained in this message is strict= ly confidential. It is intended only for the use of the individual or entit= y named above. If the reader is not the intended recipient, or the authoris= ed agent thereof, you are hereby notified that any disclosure, use, distrib= ution or copying of the within information is strictly prohibited. If you h= ave received this message in error, please notify us immediately by telepho= ne and delete all copies of the original message. * PLEASE CONSIDER THE ENVIRONMENT BEFORE YOU PRINT THIS E-MAIL --_000_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_ Content-Type: text/html; charset="us-ascii" Content-Transfer-Encoding: quoted-printable

I have a client who is still running RHEL3. Over the last 12 mon= ths the auditd process has become steadily more and more intrusive and caus= ing problems. I have attempted to turn it off but whenever I do= so, suddenly SSH logins stop working.

At the moment the only way I have to manage the auditd process is to r= egularly delete the 2+GB of log files it creates every 4 hours. &n= bsp; Can anybody tell me how to turn it off without affecting other things?=

Cheers

Brian Ross

Brian Ross
Technical Consultant

ASG Group Limited
Level 1 / 267 St Georges Tce.
Perth, WA, 6000
Telephone = ; +61 8 9420 5451

Mobile = ; &n= bsp; +61 0434 181 701

Facsimile &n= bsp; +61 8 9420 5422

Brian.Ross@asggroup.com.au

http:= //www.asggroup.com.au/

Confidentiality Notice: The inf= ormation contained in this message is strictly confidential. It is intended= only for the use of the= individual or entity named above. If the reader is not the intended recipient, or the authorised agent thereof, you = are hereby notified that any disclosure, use, distribution or copying of th= e within information is strictly prohibited. If you have received this message in error, please notify us immediately by telephone a= nd delete all copies of the original message.
P= PLEASE CONSIDER THE ENVIRON= MENT BEFORE YOU PRINT THIS E-MAIL

--_000_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_-- --_004_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_ Content-Type: image/jpeg; name="Picture (Device Independent Bitmap) 1.jpg" Content-Description: Picture (Device Independent Bitmap) 1.jpg Content-Disposition: inline; filename="Picture (Device Independent Bitmap) 1.jpg"; creation-date="Tue, 22 Nov 2011 09:04:07 GMT"; modification-date="Tue, 22 Nov 2011 09:04:07 GMT" Content-ID: Content-Transfer-Encoding: base64 /9j/4AAQSkZJRgABAQEAYABgAAD/2wBDAAgGBgcGBQgHBwcJCQgKDBQNDAsLDBkSEw8UHRofHh0a HBwgJC4nICIsIxwcKDcpLDAxNDQ0Hyc5PTgyPC4zNDL/2wBDAQkJCQwLDBgNDRgyIRwhMjIyMjIy MjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjIyMjL/wAARCABNAQIDASIA AhEBAxEB/8QAHwAAAQUBAQEBAQEAAAAAAAAAAAECAwQFBgcICQoL/8QAtRAAAgEDAwIEAwUFBAQA AAF9AQIDAAQRBRIhMUEGE1FhByJxFDKBkaEII0KxwRVS0fAkM2JyggkKFhcYGRolJicoKSo0NTY3 ODk6Q0RFRkdISUpTVFVWV1hZWmNkZWZnaGlqc3R1dnd4eXqDhIWGh4iJipKTlJWWl5iZmqKjpKWm p6ipqrKztLW2t7i5usLDxMXGx8jJytLT1NXW19jZ2uHi4+Tl5ufo6erx8vP09fb3+Pn6/8QAHwEA AwEBAQEBAQEBAQAAAAAAAAECAwQFBgcICQoL/8QAtREAAgECBAQDBAcFBAQAAQJ3AAECAxEEBSEx BhJBUQdhcRMiMoEIFEKRobHBCSMzUvAVYnLRChYkNOEl8RcYGRomJygpKjU2Nzg5OkNERUZHSElK U1RVVldYWVpjZGVmZ2hpanN0dXZ3eHl6goOEhYaHiImKkpOUlZaXmJmaoqOkpaanqKmqsrO0tba3 uLm6wsPExcbHyMnK0tPU1dbX2Nna4uPk5ebn6Onq8vP09fb3+Pn6/9oADAMBAAIRAxEAPwD3yiii gAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKA CiiigAooooAKiubiO0tZbiU4jiQu30AqWuR8fal9m0qOyRsSXLfN/uDr+uK1o03UqKHc5sXiFh6E qr6L/hjPXx7eyOStnbhCeAWOcV2mnXqajYQ3cYwsi5xnoe4rzSz0Z5PCtxquDvSUbR6oOG/U/pXR +BtQDLPYMeR+9T6dD/SuzFUKai3TW254uWY3EOrGGId+dXR0Wq6vBpca7wXlf7kY6n39hXOv4pvm b5VgQem0mqPiGZpNeudx+5hV9hiuz0+xtbazjWGNMFQS2MluOua8qpCb0TserCpOtUlGLskY1l4n dpFS6iUqxxvj7fhXTVn3mjWl2A2wRSAgh0GD+PrTdavzYWPyHEsh2ofT1NZRc6UZSqu6R1R5or3m JqGt29ixjAMsw6qp6fU1kP4jvGPyrCg7DBNVtK019SnYsxWJeXfuT6fWuph06zt02x28f1IyT+Jr zUsZi/ejLkiUnfUwYvElyrfvYo5F/wBng10NndR3tqk8eQrdj1FRz6ZZ3CkPAgP95Rgj8qdYWYsb UQB94BJBI9TXThKWLpVOWrPmjb53KLNZFnq8lxrVzZvEiwrkQyA8uVxuB/MVrMQqlj0Aya5e3Bi0 ex1T+JbppnP+xIxB/Qg/hXpAaWpavJZ6laW0cSPG7Dz2J+4rHauPxrQuLy1tMfaLiKLPTe4XP51z 93GbvTNavxyS+Ij/ALMR7fiGq5Ldpe3nl22mx3UqRKZJJSFCBhkLkgk+tAGu1xAkImeaNYjyHLAL +dRw39ncK7Q3UMgQZYrIDtHqa5e1jDabp8MsahF1Rk8rqqgbuB7Vq6jaW8eraY0cMaGR3ifaoG5C h4PqKANoMrKGDAqRkEHgikSRJEDo6sh5DKcg1zUc8ttok+lK3+lRzfY4j/st91v++SfyrdexT+ym sImMaeSYlI6jjGaAHw31pcSNHBcwyOvVUcEikkv7OGcQSXUKSn+BnAP5ViRSyacI7W406KO6WB1t p4QCrlVzj1BOOlW9I0+xl0OAtDHMJ4w8ruoJdiOST9aAJNQmkj1fSo0kZUkeQOoOA2F4zWkkiSLu R1ZfVTkVy1hI8kmihnLolxOkbk53IAQP0rT0H/kBMB/z0m/9DagCxdazaWtxaxNLGRcE4YOMKMZy fbtUqyzSagnlz27WjQ7goOXJz94dtuK5y1hie28N74kbJYHKg5G08Vb1RntdVuHtlCvHpbmMKOhD dhQBttf2aT+Q11CJumwyDP5U+e5gtk3zzRxL6uwA/Ws600vTX0SOMwxPFJEGaQgEsSMlifX3rK0/ /TZtCNyBN+5mwZBncAQAefbFAHTW91b3SF7eeOVR1KMGx+VMivrSeZoobmGSReqK4JH4Vkz2cS+I fJgAg+02UiuYxjJyADj1GaSwP9n3NnY3unwxybTHBcw4KsQOR6qSKAN+iiigAooooAK8i8T376z4 mlSH51Rhbwgd+cfqc16P4l1MaToF1dbgJNuyP3Y8D/H8K8f0zUDpuoQ3uxJXibcFkzgn14r1stpO 0qtvJHzmfV4tww7ej1foe0WmmxW+jR6cVBjEXlsPXI5/rXmtjNJoPiACTINtMUf3Xp/LmtO2+IGq XdxFBDZWrSSMFUDceT+NL4509rfUYL7aNtwmyQr03j/638qKNKdObp1ftGWOr0q9GNfDf8u2unT+ kjY8S6NLPMNRs0MoZR5iL1x2IrL0/Xb6wXykcNGvHlyj7v8AUV0XhLURf6JGjNmW3/dt9B0P5Vp3 WmWV7/r7dGb+9jB/OvMqxcW4PdHq06PtksRRlbm1M/TvEtvdyLDOvkSscDJyp/GqPihz9st0/hEZ P5n/AOtWXrOmDTLwRoxaKRdyE9R7VZ1FnuNL068fJJQxMT6jp/I152IcpU5QZsqs2nCe6N/w8gXS I2HVyWJ/Grl3fQWKq07FQxwCATWZ4ZulksmtifniYkD1U1qXlnFfW5hlztJyCOoNaU+b6uvZb2Oq DvFWKn9v6d/z1b/vg1btL2C+RngfcFODxjFc9qujw6faLKkjsxcLhsYq14Y/1dz/ALy/yrho4zE/ WlQrJa9vT1KN2SNZYnjbO11KnBxwag+w2/8AZ32DZm38vy9uf4cYqzWNDdahq5aWzkjtbIMVSRk3 vLjjIGcAV7AzQhsYINPFiinyAhjwTzg9earHRLX920TzwyJGI98UpUso6A+tRJeXthew22omOWGd tkVzGu3D9lZffsRVi51vTbSZop7uNZF+8vJI+uOlABFpFrDDDEA5EU3nqWckl+eSe/U1YmtIp5oJ ZAS8DFkwe5GP60q3du1qLoTxm3K7vM3Dbj1zUNpqtjfSGO2uUkcDO0cHHrzQBTFl53il7sxMqQQh dx6O57j1wOPxrVljSaF4nyUcFTg44rK8SXiWulmMzeU0zKgIOCV3Ddg/Sn2txo+nWJmt5o47Z3wD uJBb2B/pQBNb6TBBcpcNLcTSICsZmkLbAeuP8aibQbQlwklxFFISXhimKoSevHbPtVu0v7W/RmtZ 0lCnDAdVPuOoqGbW9Nt5zBLeRLIpwwz90+57UASnT7bfassez7LnylXgLkY6VXfRLcyyvDNc24lJ Z0hlKqSepxV6OeKV5EjkVmjO1wD904zUUmoWcMEk0lxGscTlHYno3p9aAIH0a0ayt7VfNRbcgxOj kOp+tSw6dBDOk2ZHkWIxbpHLEqTk59eafaX1tfIz20yyKp2tjqD7irFAGUfD9ntaNXuFt2OTbrMR GfbHp7Vd+wwfaIJwm1oEKRhTgAHHb8KsUUAVpbGCe58+QMX8pouGIG09agt9HgguI5mluJniBEfn SlgmfStCigCtY2MOn2/kQFym4t87FjknPU1ZoooAKKKKAPNPiXqm+7ttMRvliXzZOf4j0H5ZP41t +BdDt4vDqXNzbxyS3LeYN6A4XoOv5/jWxdeFtFvbt7q5sI5ZnOWZieT+da6IsaKiKFVRgAdAK7qm Kj9XjRp6dzy6WAl9bliKrTvsiGOxtIXDxWsKOOjLGARVbWtLj1jS5bR8Bjyjf3WHQ1oUVxqclJST 1R6EqUJQcGtGeT2d1qPhrVWVlMcy8PG33ZB/Ue9ddF43t3iBeymEncBgR+ddDeafaahHsu7eOZR0 3DkfQ1ljwho4bIgkHsJGxXXVr0qyvJWkePRwGLwrcaE04ef/AAxzN7qFxrWoqVj+cjZHEvOK7FNJ RtETT5T0T7w7N1yPxqez02z09SLW3SMnqQOT+NW64ZRi2z0qFCULuo7tnByw3mjXgJJjdT8sgHys P89q2YPFHyAT2xLesZ6/ga6CSKOZCkiK6nqGGaz30DTnbIgK/wC6xFcMsPWg/wBzL7zSNOUfhZja prK6hbiFIWQBt25jV3wvzFc/7w/lV6PQtOjOfI3H/aYmr6RpEgSNFVR0CjArKjg631hV60ldGiT6 iSoZIXQHBZSM+lZfh2dDpUdocLcWo8qaM9VI7/Q9c1r1SvNIsb6QSzwAygY8xSVbHpkV6hRS1yRb iey06Ihrh50lKj+BFOSx9PSn6Mqm61Y7Rk3hzx/srV2y02008N9mhVC33m6s31J5qWG2ht2laKMK ZX3uR/E3TP6UAcjIhW1WFTFHbDVnBEikxjuoI9M1tPp19NfWk9xcWgMEm5THEVYjBBXJPStD7Bae RNAYEMUzF5EIyGJ6k1BbaLYWk6zRRHen3Czs236ZPFAEPiMA6UOAf30X/oYqMBG8Wss4GVtgbYN0 6neR79K1bi2huovKnjDpkNg+oOR+tR3lhbX6KlzEH2nKnoVPsRyKAMjU/wB3r0RsRi7a1m80J1Ix 8hP/AALpVzQ47M6FbeSqNG0YLkjOW/iz75zVqz060sA/2eIKz/fcklm+pPNV5dA02aZ5WtsM5y4V iqufcA4NAEWkkf2rrC5GfPU49tgxVKCxe8jujFKkc8OpSSx71ypI7EfQ1rXWj2N3KJZIcShdu9GK HHpkHmm/2Lp4sxaiD90H8wfMc7vXOc5oAbp9+ZJbuG7hjguYCvmsrZVgRwQf6GtKs/8AsTTzYyWb W4aGUhpAxJLEdyepq+AFUADAAwKAFooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiig AooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigAooooAKKKKACiiigD//Z --_004_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_ Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --_004_6BE4AAFB10DD834E8F60D36312048EAA0191691E44EFPDCPXMB003a_-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Stephen John Smoogen Subject: Re: I'd like to turn auditd off but... Date: Mon, 21 Nov 2011 18:12:57 -0700 Message-ID: References: <6BE4AAFB10DD834E8F60D36312048EAA0191691E44EF@PDCPXMB003.asggroup.com.au> Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============2936780136041407116==" Return-path: Received: from mx1.redhat.com (ext-mx12.extmail.prod.ext.phx2.redhat.com [10.5.110.17]) by int-mx01.intmail.prod.int.phx2.redhat.com (8.13.8/8.13.8) with ESMTP id pAM1D600018835 for ; Mon, 21 Nov 2011 20:13:06 -0500 Received: from mail-ey0-f174.google.com (mail-ey0-f174.google.com [209.85.215.174]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id pAM1CvQ1013481 for ; Mon, 21 Nov 2011 20:12:58 -0500 Received: by eye27 with SMTP id 27so8370148eye.33 for ; Mon, 21 Nov 2011 17:12:57 -0800 (PST) In-Reply-To: <6BE4AAFB10DD834E8F60D36312048EAA0191691E44EF@PDCPXMB003.asggroup.com.au> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com --===============2936780136041407116== Content-Type: multipart/alternative; boundary=bcaec53d5ec9ed84e904b24880ac --bcaec53d5ec9ed84e904b24880ac Content-Type: text/plain; charset=ISO-8859-1 On 21 November 2011 18:04, Brian Ross wrote: > I have a client who is still running RHEL3. Over the last 12 months the > auditd process has become steadily more and more intrusive and causing > problems. I have attempted to turn it off but whenever I do so, suddenly > SSH logins stop working. > > At the moment the only way I have to manage the auditd process is to > regularly delete the 2+GB of log files it creates every 4 hours. Can > anybody tell me how to turn it off without affecting other things? > > I would say that your user has other problems that need to be addressed before you can turn off audit. 1) Audit doesn't have anything to do with sshd that I can remember in RHEL-3. So if one is turning off the other.. then I would start looking at compromised system. 2) 2GB every 4 hours means there is something really wrong. Again I would say its either compromised system or hardware issue. -- Stephen J Smoogen. "The core skill of innovators is error recovery, not failure avoidance." Randy Nelson, President of Pixar University. "Let us be kind, one to another, for most of us are fighting a hard battle." -- Ian MacLaren --bcaec53d5ec9ed84e904b24880ac Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: quoted-printable

On 21 November 2011 18:04, Brian Ross <Brian.Ros= s@asggroup.com.au> wrote:

I have a client who is still running RHEL3.=A0 Over the last 12 months= the auditd process has become steadily more and more intrusive and causing= problems.=A0=A0 I have attempted to turn it off but whenever I do so, sudd= enly SSH logins stop working.

=A0

At the moment the only way I have to manage the auditd process is to r= egularly delete the 2+GB of log files it creates every 4 hours.=A0=A0 Can a= nybody tell me how to turn it off without affecting other things?

=A0

I would say that your user has other problems th= at need to be addressed before you can turn off audit.

1) Audit doesn't have anything to do with sshd that I can remember= in RHEL-3. So if one is turning off the other.. then I would start looking= at compromised system.
2) 2GB every 4 hours means there is somet= hing really wrong. Again I would say its either compromised system or hardw= are issue.=A0

--
Stephen J Smoogen.
"The core skill of i= nnovators is error recovery, not failure avoidance."
Randy Nelson, = President of Pixar University.
"Let us be kind, one to another, for= most of us are fighting a hard
battle." -- Ian MacLaren

--bcaec53d5ec9ed84e904b24880ac-- --===============2936780136041407116== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============2936780136041407116==-- From mboxrd@z Thu Jan 1 00:00:00 1970 From: Linda Knippers Subject: Re: I'd like to turn auditd off but... Date: Mon, 21 Nov 2011 21:30:52 -0500 Message-ID: <4ECB095C.9040203@hp.com> References: <6BE4AAFB10DD834E8F60D36312048EAA0191691E44EF@PDCPXMB003.asggroup.com.au> Reply-To: linda.knippers@hp.com Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx14.extmail.prod.ext.phx2.redhat.com [10.5.110.19]) by int-mx09.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id pAM36hVG004398 for ; Mon, 21 Nov 2011 22:06:43 -0500 Received: from g6t0184.atlanta.hp.com (g6t0184.atlanta.hp.com [15.193.32.61]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id pAM36ZZi012378 for ; Mon, 21 Nov 2011 22:06:36 -0500 In-Reply-To: <6BE4AAFB10DD834E8F60D36312048EAA0191691E44EF@PDCPXMB003.asggroup.com.au> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Brian Ross Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com Brian Ross wrote: > I have a client who is still running RHEL3. Over the last 12 months the auditd process > has become steadily more and more intrusive and causing problems. I have attempted to > turn it off but whenever I do so, suddenly SSH logins stop working. > > At the moment the only way I have to manage the auditd process is to regularly delete > the 2+GB of log files it creates every 4 hours. Can anybody tell me how to turn it > off without affecting other things? If other services stop running when you turn off auditing, that probably means that those services are configured to audit their activity and to fail if they can't audit. The audit subsystem in RHEL3 was based on the LAuS subsystem and is different from more modern releases. The configuration guide HP posted when we did our common criteria evaluation for RHEL3 is posted here: http://h71028.www7.hp.com/enterprise/downloads/HP-RHEL-EAL3-Configuration-Guide.pdf It describes LAuS, its configuration files and the pam configuration that might be in use. By fiddling with the pam_laus.so configuration in the various /etc/pamd.d/files, you may be able to disable or relax the audit requirement. There are also options that tell the LAuS auditd to reuse audit files rather than consuming more space, so you might want to check those. It sounds like you've got something wrong, either with the system or the audit rules you're using, if you're generating that much audit traffic so if you actually do want to run audit, then you might check the rules and investigate why you're getting so much traffic. Yeah, I'm stating the obvious. :-) -- ljk > > Cheers > > Brian Ross > > Brian Ross > Technical Consultant > > ASG Group Limited > Level 1 / 267 St Georges Tce. > Perth, WA, 6000 > Telephone +61 8 9420 5451 > Mobile +61 0434 181 701 > Facsimile +61 8 9420 5422 > Brian.Ross@asggroup.com.au > http://www.asggroup.com.au/ > > [cid:image001.gif@01CBB23E.C8A47A50] > Confidentiality Notice: The information contained in this message is strictly confidential. It is intended only for the use of the individual or entity named above. If the reader is not the intended recipient, or the authorised agent thereof, you are hereby notified that any disclosure, use, distribution or copying of the within information is strictly prohibited. If you have received this message in error, please notify us immediately by telephone and delete all copies of the original message. > * PLEASE CONSIDER THE ENVIRONMENT BEFORE YOU PRINT THIS E-MAIL > > > > > > > ------------------------------------------------------------------------ > > > ------------------------------------------------------------------------ > > -- > Linux-audit mailing list > Linux-audit@redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit