 | | | audit disable not working? | audit disable not working? 2005-03-30 - By Jussi Silvennoinen
Back
> Hello,
>
> We've turned off the audit service and added "alias char-major-10-209
> off" to /etc/modules.conf, but the audit kernel module is still loading
> and we end up with tons of issues. For example, from /var/log/cron:
>
> Mar 30 08:01:00 surfu CROND[32352]: (root) CMD (run-
> parts /etc/cron.hourly)
> Mar 30 08:01:00 surfu CROND[32352]: LAuS error - do_command.c:226 -
> laus_attach: (19) laus_attach: No such device
> Mar 30 08:10:00 surfu CROND[32641]: (root) CMD (/usr/lib/sa/sa1 1 1)
> Mar 30 08:10:00 surfu CROND[32641]: LAuS error - do_command.c:226 -
> laus_attach: (19) laus_attach: No such device
>
> [root@(protected) httpd]# lsmod | grep audi
> audit 90712 2 (autoclean)
> [root@(protected) httpd]# chkconfig --list audit
> audit 0:off 1:off 2:off 3:off 4:off 5:off 6:off
> [root@(protected) httpd]# service audit status
> auditd is stopped
>
> What else needs to be done to completely get rid of laus issues? Or
> should the service be re-enabled and audit.conf be used to configure it
> properly? We've had audit fill up a 4GB /var filesystem in the past.
> We've also seen it adversely affect local disk IO during compiles. Has
> anyone else run into issues and successfully disabled it?
Not exactly disabled but removing all laus-packages except laus-libs will
kill this troublemaker. Afterwards make sure that there's /dev/audit
leftover.
I'd rather install the easter bunny on my servers than this garbage
--
Jussi
--
Taroon-list mailing list
Taroon-list@(protected)
http://www.redhat.com/mailman/listinfo/taroon-list
Earn $52 per hosting referral at Lunarpages.
|
|
|