taroon-list@redhat.com
[Top] [All Lists]

Re: audit disable not working?

Subject: Re: audit disable not working?
From: Jussi Silvennoinen
Date: Wed, 30 Mar 2005 20:53:11 +0300 EEST
> Hello,
> 
> We've turned off the audit service and added "alias char-major-10-209
> off" to /etc/modules.conf, but the audit kernel module is still loading
> and we end up with tons of issues.  For example, from /var/log/cron:
> 
> Mar 30 08:01:00 surfu CROND[32352]: (root) CMD (run-
> parts /etc/cron.hourly)
> Mar 30 08:01:00 surfu CROND[32352]: LAuS error - do_command.c:226 -
> laus_attach: (19) laus_attach: No such device
> Mar 30 08:10:00 surfu CROND[32641]: (root) CMD (/usr/lib/sa/sa1 1 1)
> Mar 30 08:10:00 surfu CROND[32641]: LAuS error - do_command.c:226 -
> laus_attach: (19) laus_attach: No such device
> 
> [root@surfu httpd]# lsmod | grep audi
> audit                  90712   2  (autoclean)
> [root@surfu httpd]# chkconfig --list audit
> audit           0:off   1:off   2:off   3:off   4:off   5:off   6:off
> [root@surfu httpd]# service audit status
> auditd is stopped
> 
> What else needs to be done to completely get rid of laus issues?  Or
> should the service be re-enabled and audit.conf be used to configure it
> properly?  We've had audit fill up a 4GB /var filesystem in the past.
> We've also seen it adversely affect local disk IO during compiles.  Has
> anyone else run into issues and successfully disabled it?

Not exactly disabled but removing all laus-packages except laus-libs will 
kill this troublemaker. Afterwards make sure that there's /dev/audit 
leftover.

I'd rather install the easter bunny on my servers than this garbage

-- 

  Jussi

--
Taroon-list mailing list
Taroon-list@xxxxxxxxxx
http://www.redhat.com/mailman/listinfo/taroon-list

<Prev in Thread] Current Thread [Next in Thread>