Well, Ted, it's not really that bad. A little RTFM (or release notes in this case) and it was fixed. All I had to do was start the auditd user-space tools and the messages are logged to /var/log/audit/audit.log. All I wanted was to get them out of /var/log/messages and the ring buffer.
Kirk
Ted Kaczmarek wrote:
On Mon, 2005-10-17 at 09:19 -0700, Kirk Bocek wrote:
Since updating to 4.2 my Opteron server has been flooded by messages like:
audit(1129565701.837:155): user pid=4700 uid=0 auid=4294967295 msg='PAM session open: user=root exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron result=Success)'
to both /var/log/messages and the kernel ring buffer. Looks like they are being generated by cron jobs being run on the server.
Does anyone know how to turn these messages off or to redirect them?
Kirk
Man I am glad you posted this, guess I will be staying on 4.1 for a while :-)
Ted
CentOS mailing list CentOS@centos.org http://lists.centos.org/mailman/listinfo/centos