From mboxrd@z Thu Jan 1 00:00:00 1970 From: Peter Moody Subject: Re: Completely disable audit.log, only pass logs through dispatcher Date: Wed, 25 Dec 2013 11:53:21 -0800 Message-ID: <8738lgvham.fsf@root.hda3.com> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx11.extmail.prod.ext.phx2.redhat.com [10.5.110.16]) by int-mx12.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id rBPJrONh008754 for ; Wed, 25 Dec 2013 14:53:24 -0500 Received: from mail-pd0-f171.google.com (mail-pd0-f171.google.com [209.85.192.171]) by mx1.redhat.com (8.14.4/8.14.4) with ESMTP id rBPJrNNF016631 for ; Wed, 25 Dec 2013 14:53:23 -0500 Received: by mail-pd0-f171.google.com with SMTP id z10so7393433pdj.2 for ; Wed, 25 Dec 2013 11:53:23 -0800 (PST) In-Reply-To: (Aaron Lewis's message of "Wed, 25 Dec 2013 19:21:25 +0800") List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Aaron Lewis Cc: "linux-audit@redhat.com" List-Id: linux-audit@redhat.com I asked this same question a couple of months ago. https://www.redhat.com/archives/linux-audit/2013-October/msg00083.html On Wed, Dec 25 2013 at 03:21, Aaron Lewis wrote: > Hi, > > is it possible to completely disable audit log? > > I use a dispatcher to handle everything and doens't want anything on disk. > (And I don't care for a trivial data loss) > > I tried to set the log to /dev/null, but auditd doesn't accept that