28 Jun
2010
28 Jun
'10
12:24 a.m.
Hello everyone,
I have this box where auditd is logging every command typed on the system onto: /var/log/audit/audit.log
Every line looks like: type=USER_TTY msg=audit msg=audit(124433....<snip> msg="command here" ...
The strange thing is that I have other similar boxes and I don't see this behavior. I don't see any option in /etc/audit/* or any PAM module triggering it. Is there a way to stop this? I don't want to stop the service since "setroubleshoot" needs it. Any ideas?
Thanks! Jorge