From mboxrd@z Thu Jan 1 00:00:00 1970 From: Paul Moore Subject: Excluding certain audit message types? Date: Fri, 7 Dec 2007 11:12:56 -0500 Message-ID: <200712071112.56880.paul.moore@hp.com> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id lB7GDejY013064 for ; Fri, 7 Dec 2007 11:13:40 -0500 Received: from g5t0007.atlanta.hp.com (g5t0007.atlanta.hp.com [15.192.0.44]) by mx3.redhat.com (8.13.1/8.13.1) with ESMTP id lB7GD8a4017997 for ; Fri, 7 Dec 2007 11:13:08 -0500 Received: from g5t0007.atlanta.hp.com (localhost.localdomain [127.0.0.1]) by receive-from-antispam-filter (Postfix) with SMTP id F36E6140F3 for ; Fri, 7 Dec 2007 16:13:02 +0000 (UTC) Received: from smtp2.fc.hp.com (smtp2.fc.hp.com [15.11.136.114]) by g5t0007.atlanta.hp.com (Postfix) with ESMTP id E8CEE140CE for ; Fri, 7 Dec 2007 16:13:02 +0000 (UTC) Received: from ldl.fc.hp.com (ldl.fc.hp.com [15.11.146.30]) by smtp2.fc.hp.com (Postfix) with ESMTP id B3ECF24A38D for ; Fri, 7 Dec 2007 16:13:02 +0000 (UTC) Received: from localhost (ldl.fc.hp.com [127.0.0.1]) by ldl.fc.hp.com (Postfix) with ESMTP id 98FBB134003 for ; Fri, 7 Dec 2007 09:13:02 -0700 (MST) Received: from ldl.fc.hp.com ([127.0.0.1]) by localhost (ldl.fc.hp.com [127.0.0.1]) (amavisd-new, port 10024) with ESMTP id nej9ZJqtMSEe for ; Fri, 7 Dec 2007 09:12:57 -0700 (MST) Received: from flek.americas.hpqcorp.net (flek.americas.hpqcorp.net [16.116.102.14]) (using TLSv1 with cipher DHE-RSA-AES256-SHA (256/256 bits)) (No client certificate requested) by ldl.fc.hp.com (Postfix) with ESMTP id AF365134002 for ; Fri, 7 Dec 2007 09:12:57 -0700 (MST) Content-Disposition: inline List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com Hello friendly audit people, I have a pretty simple question which I hope has a pretty simple answer. Is it possible to exclude a specific audit message type from the audit log? The auditctl man page looks like it might be possible using the syntax below but I'm not sure ... # auditctl -a exclude,always -F msgtype=1415 -- paul moore linux security @ hp