From mboxrd@z Thu Jan 1 00:00:00 1970 From: Ian Pilcher Subject: "write_logs = no" not working Date: Sun, 5 Mar 2017 20:38:51 -0600 Message-ID: Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii"; Format="flowed" Content-Transfer-Encoding: 7bit Return-path: Received: from mx1.redhat.com (ext-mx02.extmail.prod.ext.phx2.redhat.com [10.5.110.26]) by int-mx14.intmail.prod.int.phx2.redhat.com (8.14.4/8.14.4) with ESMTP id v264kEFC017980 (version=TLSv1/SSLv3 cipher=DHE-RSA-AES256-GCM-SHA384 bits=256 verify=NO) for ; Sun, 5 Mar 2017 23:46:14 -0500 Received: from blaine.gmane.org (unknown [195.159.176.226]) (using TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)) (No client certificate requested) by mx1.redhat.com (Postfix) with ESMTPS id 8ABD786647 for ; Mon, 6 Mar 2017 04:46:13 +0000 (UTC) Received: from list by blaine.gmane.org with local (Exim 4.84_2) (envelope-from ) id 1ckie1-0007Ms-T5 for linux-audit@redhat.com; Mon, 06 Mar 2017 03:45:05 +0100 List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com I have a Banana Pi-based firewall system, which runs off a micro-SD card and sends all of its logs (including audit events) to a syslog server. I have set "write_logs = no" in /etc/audit/auditd.conf, but the local log file is still being written. (Commenting out the log_file line causes auditd to abort.) What do I need to do to disable writing the local file? (This is audit 2.6.5 on CentOS 7.) -- ======================================================================== Ian Pilcher arequipeno@gmail.com -------- "I grew up before Mark Zuckerberg invented friendship" -------- ========================================================================