From mboxrd@z Thu Jan 1 00:00:00 1970 From: Steve Grubb Subject: Re: Stop/Disable AUDITD on RHEL7 Date: Fri, 04 Aug 2017 15:31:25 -0400 Message-ID: <3214254.px8za6mvnA@x2> References: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com On Thursday, August 3, 2017 5:12:39 PM EDT warron.french wrote: > I am running RHEL 7 Server so that I can also run Red Hat Satellite. > > I seem to be having resource contention problems and auditd is a part of > the problem consuming up to 22.0% according to results of the *top* command. I'd be curious what the flush technique is in auditd.conf. > I have: > > 1. executed a *systemctl disable auditd; systemctl stop auditd* (with > an error about dependencies) "service auditd stop" is the correct way to stop auditd. > 2. executed a *service auditd stop (*and the service stops but doesn't > not remain stopped). Do you have some systems management software that is sneaking in behind you and modifying settings and starting it? > 3. Rebooting the machine after the *systemctl disable auditd *also > didn't have any effect. It should. I don't know how else it could get re-enabled without some systems management software also configuring it when you're not looking. -Steve > I did set -e 1 in the audit.rules file so that I could stop the auditd on > my demand, but the service restarts anyway. > > > Thanks for your help in advance. > -------------------------- > Warron French