From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Way too many logs!
Date: Fri, 9 May 2008 16:43:38 -0400
Message-ID: <200805091643.38420.sgrubb@redhat.com>
References: <482479DC020000100005CB37@gsi.gracon.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <482479DC020000100005CB37@gsi.gracon.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday 09 May 2008 16:20:44 Jeremy Leonard wrote:
> How can I exclude this so it doesn't get logged?
>
> The rules I have above are required by the government. DIACAP STIG

Do you need to log all changes to the scheduler? Or just the changes caused by 
users? If the latter, you can cut back your events like this:

-a exit,always -S sched_setparam -S sched_setscheduler -F auid>=500 -k RULE7


-Steve