Mailing List
Home
Forum Home
Linux - General Red Hat Linux discussion list
Enterprise Linux 3 - Discussion of Red Hat Enterprise Linux 3 (Taroon)
Installation - Getting started with Red Hat Linux
Red Hat Linux 9 - Discussion of Red Hat Linux 9 (Shrike)
Red Hat Linux 7.3 - Discussion of Red Hat Linux 7.3 (Valhalla)
Red Hat Linux 7.2 - Discussion of Red Hat Linux 7.2 (Enigma)
Apache Web Server
Oracle database, Microsoft SQL server ...
Subjects
• application/x mplayer2 plugin
• RPM error: db4 error(16) from dbenv >remove: Device or resource
   busy
• Command stream end of file while reading
• X Windows problem (xauth)
• Upgrading openoffice 1 1 rpm
• FTP: connection refused
• FTP: connection refused
• mount: /dev/cdrom: is not a valid block device
• Dell Precision 650, RedHat 9, no sound
• how to trace the cause resulting in the crash of bind server
• Virus on the list
• UNINSTALL RPM MYSQL
• usb pen drives: mounting as a user
• broadcom network interface
• make mrproper
• sendmail configuration on redhat
• Couldn 't open PID file /var/run/named/named pid Permission denied
• Promise 378 controller
• kernel 2 6 and /dev/sound/mixer not found
• Problem using up2date
• mrtg step by step howto/configuration for a newbie?
• Compiling and Installing Kernel 2 6
• Can 't locate module ppp0, can 't locate module ppp compress 21
• HOW I CAN MAKE BOOTABLE FLOPPY DISKET
• Lotus Notes under Wine
• /etc/security/limits conf question
• Intel E/1000 driver
• Command stream end of file while reading
• rpm database corrupt
• qla2300 modules
 
Search:  
Power your search with and, or, +, -, or "some phrase" operators.
audit disable not working?

audit disable not working?

2005-03-30       - By Brian Long

 Back
Reply:     1     2     3     4     5     6     7     8     9     10     >>  

Hello,

We've turned off the audit service and added "alias char-major-10-209
off" to /etc/modules.conf, but the audit kernel module is still loading
and we end up with tons of issues.  For example, from /var/log/cron:

Mar 30 08:01:00 surfu CROND[32352]: (root) CMD (run-
parts /etc/cron.hourly)
Mar 30 08:01:00 surfu CROND[32352]: LAuS error - do_command.c:226 -
laus_attach: (19) laus_attach: No such device
Mar 30 08:10:00 surfu CROND[32641]: (root) CMD (/usr/lib/sa/sa1 1 1)
Mar 30 08:10:00 surfu CROND[32641]: LAuS error - do_command.c:226 -
laus_attach: (19) laus_attach: No such device

[root@(protected) httpd]# lsmod | grep audi
audit                  90712   2  (autoclean)
[root@(protected) httpd]# chkconfig --list audit
audit           0:off   1:off   2:off   3:off   4:off   5:off   6:off
[root@(protected) httpd]# service audit status
auditd is stopped

What else needs to be done to completely get rid of laus issues?  Or
should the service be re-enabled and audit.conf be used to configure it
properly?  We've had audit fill up a 4GB /var filesystem in the past.
We've also seen it adversely affect local disk IO during compiles.  Has
anyone else run into issues and successfully disabled it?

/Brian/
--
      Brian Long                      |         |           |
      IT Data Center Systems          |       .|||.       .|||.
      Cisco Linux Developer           |   ..:|||||||:...:|||||||:..
      Phone: (919) 392-7363           |   C i s c o   S y s t e m s

--
Taroon-list mailing list
Taroon-list@(protected)
http://www.redhat.com/mailman/listinfo/taroon-list

Earn $52 per hosting referral at Lunarpages.