3.13, audit pollutes my log

hamelg · 2014-02-28 19:44:13

Hello,

since kernel 3.13, my log is polluted by these messages :

kernel: type=1006 audit(1393615201.004:476): pid=24320 uid=0 old ...

kernel auditing is now enabled by default ?
I don't want auditing, how to disable it ?

Thank you

rusty725 · 2014-03-03 03:50:39

same here
in general I get odd messages with the new kernel like this one new driver I assume "intel_rapl: domain dram energy ctr 0:0 not working, skip"

WonderWoofy · 2014-03-03 05:07:33

On the kernel command line, just put 'audit=0'.

rusty725 · 2014-03-03 07:59:34

feels like I'm gonna have my kernel line polluted with all kind of things just to disable all these things

WonderWoofy · 2014-03-03 16:09:57

There is a userspace tool called 'auditctl' that can disable the audit functionality apparently. (See the man page here). So I am sure you could set up a systemd service to run this on boot.

The only thing is that you might actually still end up with audit messages before this is run of course. This, and the fact that I have never actually tried to use the autid package, is why I suggested you use 'audit=0'.

But then you might end up polluting your 'systemctl' output with services and your 'pacman -Q' output with packages...

Arch Linux

#1 2014-02-28 19:44:13

3.13, audit pollutes my log

#2 2014-03-03 03:50:39

Re: 3.13, audit pollutes my log

#3 2014-03-03 05:07:33

Re: 3.13, audit pollutes my log

#4 2014-03-03 07:59:34

Re: 3.13, audit pollutes my log

#5 2014-03-03 16:09:57

Re: 3.13, audit pollutes my log

Board footer