0

My audit.log file is full of information that i font need (and want to disable)

A lot of log lines like:

type=SYSCALL msg=audit(1467201475.671:36911834): arch=c000003e syscall=2 success=yes exit=49 a0=7f770ed9f318 a1=0 a2=0 a3=7f7712c00000 items=1 ppid=1 pid=1823 auid=4294967295 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) ses=4294967295 comm="splunkd" exe="/opt/splunkforwarder/bin/splunkd" key="audit-logs"

I know i need to delete some lines on my audit.rules file but i dont know what lines

Thanks !

abovebeyond15
  • 3
  • 1
  • 4

1 Answers1

0

Can I suggest you post your /etc/audit/audit.rules file (or the files in /etc/audit/rules.d) and we may be able to make some recommendations based on what you actually want (you'd need to advise us of this also)

BurnA
  • 421
  • 3
  • 6