Re: FW: I'd like to turn auditd off but...

Steve Grubb
2011-11-29T16:33:09Z

On Monday, November 28, 2011 01:37:23 PM Worsham, Michael wrote:
> If you have figured out a way to exclude logging via a User or UID, please
> post it. Our Oracle OEM and VMware Tools daemons just spit out so much
> information it's unreal.

What kinds of events are we talking about? (assuming oracle is uid orpmpxgi):

ausearch --start today --uid orpmpxgi --raw | aureport --summary --event -i

-Steve