auditd sending logs to /var/logs/messages we want to disable it. How to do that?
/etc/audisp/plugins.d/syslog.conf
i changee active = no but still sending lots to syslog
-
You can place filters in syslog at the worst situation.Rui F Ribeiro– Rui F Ribeiro2015-11-19 23:29:15 +00:00Commented Nov 19, 2015 at 23:29
Add a comment
|
1 Answer
Edit /etc/audisp/plugins.d and change args = LOG_INFOto this: args = local6
Then edit /etc/rsyslog.conf and add local6 to the "some catch-all log files" block so it's like this:
*.=info;*.=notice;*.=warn;\
auth,authpriv.none;\
cron,daemon.none;\
mail,news.none;\
local6.none -/var/log/messages
Also change the line args = in /etc/audisp/plugins.d to:
args = LOG_LOCAL6
This was adapted from this post.
answered Nov 20, 2015 at 3:33
