On Tue, 2016-09-27 at 09:09 +0200, Jakub Jelen wrote:
On 09/27/2016 02:22 AM, Alex wrote:
> On Mon, Sep 26, 2016 at 2:53 PM, Patrick O'Callaghan
> <pocallaghan(a)gmail.com> wrote:
> > On Mon, 2016-09-26 at 14:46 -0400, Alex wrote:
> > >
> > > Hi all,
> > >
> > > I recall seeing an rsyslog entry to prevent these messages from
> > > filling my messages logs, but it no longer appears to work with f24.
> > > Is there a more specific method to disable audit messages?
> > >
> > > Sep 26 14:40:56 alex kernel: audit: type=2404
> > > audit(1474915256.442:724): pid=3297 uid=0 auid=4294967295
> > > ses=4294967295 msg='op=destroy kind=server
> > >
> > > direction=? spid=3297 suid=0 exe="/usr/sbin/sshd" hostname=?
> > > addr=184.108.40.206 terminal=? res=success'
> > >
> > > I'm not using selinux, and have enabled rsyslog. They're just not
helpful to me.
> > Edit /etc/default/grub. Look for the line beginning GRUB_CMDLINE_LINUX.
> > Add "audit=0" to the end of that line. Run:
> > grub2-mkconfig --output /boot/grub2/grub.cfg
> > Audit will be turned off when you reboot. To turn it off without
> > rebooting, do:
> > auditctl -e 0
> Thanks very much, very helpful. What is the reason this is enabled by
> default? Don't other people find it obnoxious and unhelpful?
> How does this information help the average sysadmin?
Audit is not just a log. For that reason, it is not dumped to the same
files (/var/log/secure, /var/log/messages) as other logs, but into
separate file (/var/log/audit/audit.log), when you have auditd running
(if you stop that, it is dumped into the messages, which might be
It keeps track of actions that were performed somewhere on lower level
than "average sysadmin" might need. In first place, they are needed for
the certifications in some environments. In second place, it is helpful
when you seek for more specific actions that were performed in the past.
I don't think anyone is against the idea of auditing per se. The
problem with the implementation is that a) audit lines overwhelm
everything else in the journal, and b) they are very hard to interpret
without a *lot* of background reading, i.e. they are genuinely useless
for most people other than professional sysadmins. Having them on by
default just means a huge waste of space and a good deal of