Re: FW: I'd like to turn auditd off but...

Steve Grubb
2011-11-29T16:29:28Z

On Thursday, November 24, 2011 08:28:49 PM Brian Ross wrote:
> Further to this, I've just found out that auditd is logging it seems every
> transaction that Oracle makes. I have found squillions of entries in the
> log file for the oracle user "orpmpxgi". Is there any way to quickly stop
> auditd logging for a particular user?

If you are on RHEL4 or later, you can do something like this near the top of your
rules:

-a never,exit -F uid=orpmpxgi

But that means you also won't get security relevant events either.

-Steve