On Thursday 30 June 2005 07:51, David D. Hagood wrote:
These also show up in /var/log/messages, and are thus picked up by
logwatch.
You can disable auditing, but you won't get complete SE Linux avc denial
information. This is done with audit=0 boot param, or auditctl -e 0.
The alternative is to install the audit package which will pick up these
messages and deposit them in /var/log/audit/audit.log. This keeps them out
of /var/log/messages.
-Steve