Re: Clear kernel audit buffer?

[Steve Grubb <sgrubb@redhat.com>]

On Tuesday, January 14, 2014 01:09:52 PM Aaron Lewis wrote:
> Yes, I did run auditctl -D to clear all rules. And during testing I
> have enlarged the buffer queue to 10240 messages.
> 
> Did you mean that once -D is issued, the buffer will be cleared by
> auditd, but not by linux kernel?

There is no way to directly clear the in kernel buffer. The audit system is 
supposed to keep events for disposition. If there was a simple command to dump 
events, that would be a simple way to circumvent detection. So, the best way 
to drain the queues is to give auditd more priority so it runs more often and 
longer before its time slice is up. You don't need to log to disk. But 
something has to read the events to get them out.

-Steve