taroon-list@redhat.com
[Top] [All Lists]

Re: audit disable not working?

Subject: Re: audit disable not working?
From: Ed Brown
Date: Wed, 30 Mar 2005 09:30:38 -0700
Try this:

service crond stop
rmmod audit
service crond start

-Ed



On Wed, 2005-03-30 at 09:19, Brian Long wrote:
> Hello,
> 
> We've turned off the audit service and added "alias char-major-10-209
> off" to /etc/modules.conf, but the audit kernel module is still loading
> and we end up with tons of issues.  For example, from /var/log/cron:
> 
> Mar 30 08:01:00 surfu CROND[32352]: (root) CMD (run-
> parts /etc/cron.hourly)
> Mar 30 08:01:00 surfu CROND[32352]: LAuS error - do_command.c:226 -
> laus_attach: (19) laus_attach: No such device
> Mar 30 08:10:00 surfu CROND[32641]: (root) CMD (/usr/lib/sa/sa1 1 1)
> Mar 30 08:10:00 surfu CROND[32641]: LAuS error - do_command.c:226 -
> laus_attach: (19) laus_attach: No such device
> 
> [root@surfu httpd]# lsmod | grep audi
> audit                  90712   2  (autoclean)
> [root@surfu httpd]# chkconfig --list audit
> audit           0:off   1:off   2:off   3:off   4:off   5:off   6:off
> [root@surfu httpd]# service audit status
> auditd is stopped
> 
> What else needs to be done to completely get rid of laus issues?  Or
> should the service be re-enabled and audit.conf be used to configure it
> properly?  We've had audit fill up a 4GB /var filesystem in the past.
> We've also seen it adversely affect local disk IO during compiles.  Has
> anyone else run into issues and successfully disabled it?
> 
> /Brian/

--
Taroon-list mailing list
Taroon-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/taroon-list

<Prev in Thread] Current Thread [Next in Thread>