|
|
Hello,
We've turned off the audit service and added "alias char-major-10-209
off" to /etc/modules.conf, but the audit kernel module is still loading
and we end up with tons of issues. For example, from /var/log/cron:
Mar 30 08:01:00 surfu CROND[32352]: (root) CMD (run-
parts /etc/cron.hourly)
Mar 30 08:01:00 surfu CROND[32352]: LAuS error - do_command.c:226 -
laus_attach: (19) laus_attach: No such device
Mar 30 08:10:00 surfu CROND[32641]: (root) CMD (/usr/lib/sa/sa1 1 1)
Mar 30 08:10:00 surfu CROND[32641]: LAuS error - do_command.c:226 -
laus_attach: (19) laus_attach: No such device
[root@surfu httpd]# lsmod | grep audi
audit 90712 2 (autoclean)
[root@surfu httpd]# chkconfig --list audit
audit 0:off 1:off 2:off 3:off 4:off 5:off 6:off
[root@surfu httpd]# service audit status
auditd is stopped
What else needs to be done to completely get rid of laus issues? Or
should the service be re-enabled and audit.conf be used to configure it
properly? We've had audit fill up a 4GB /var filesystem in the past.
We've also seen it adversely affect local disk IO during compiles. Has
anyone else run into issues and successfully disabled it?
/Brian/
--
Brian Long | | |
IT Data Center Systems | .|||. .|||.
Cisco Linux Developer | ..:|||||||:...:|||||||:..
Phone: (919) 392-7363 | C i s c o S y s t e m s
--
Taroon-list mailing list
Taroon-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/taroon-list
|
|