From: Ian Pilcher <arequipeno@gmail.com>
To: linux-audit@redhat.com
Subject: "write_logs = no" not working
Date: Sun, 5 Mar 2017 20:38:51 -0600 [thread overview]
Message-ID: <o9ii3m$aap$1@blaine.gmane.org> (raw)
I have a Banana Pi-based firewall system, which runs off a micro-SD
card and sends all of its logs (including audit events) to a syslog
server.
I have set "write_logs = no" in /etc/audit/auditd.conf, but the local
log file is still being written. (Commenting out the log_file line
causes auditd to abort.)
What do I need to do to disable writing the local file?
(This is audit 2.6.5 on CentOS 7.)
--
========================================================================
Ian Pilcher arequipeno@gmail.com
-------- "I grew up before Mark Zuckerberg invented friendship" --------
========================================================================
next reply other threads:[~2017-03-06 4:46 UTC|newest]
Thread overview: 6+ messages / expand[flat|nested] mbox.gz Atom feed top
2017-03-06 2:38 Ian Pilcher [this message]
2017-03-06 13:34 ` "write_logs = no" not working Steve Grubb
2017-03-06 20:57 ` Ian Pilcher
-- strict thread matches above, loose matches on Subject: below --
2017-03-06 3:22 Ian Pilcher
2017-03-06 4:22 ` Stephen Buchanan
2017-03-06 4:33 ` Ian Pilcher
Reply instructions:
You may reply publicly to this message via plain-text email
using any one of the following methods:
* Save the following mbox file, import it into your mail client,
and reply-to-all from there: mbox
Avoid top-posting and favor interleaved quoting:
https://en.wikipedia.org/wiki/Posting_style#Interleaved_style
* Reply using the --to, --cc, and --in-reply-to
switches of git-send-email(1):
git send-email \
--in-reply-to='o9ii3m$aap$1@blaine.gmane.org' \
--to=arequipeno@gmail.com \
--cc=linux-audit@redhat.com \
/path/to/YOUR_REPLY
https://kernel.org/pub/software/scm/git/docs/git-send-email.html
* If your mail client supports setting the In-Reply-To header
via mailto: links, try the mailto: link
Be sure your reply has a Subject: header at the top and a blank line
before the message body.
This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox