Re: [CentOS] how to disable lots of auditd messages?

MontyRee wrote:

hello all.

My system is centos 5.x and there is no module related auditd there is no process(daemon) related auditd and selinux definately disabled.

But I can see lots of auditd messages like below.

Oct 20 02:01:01 linux kernel: type=1106 audit(1224435661.064:65210): user pid=25860 uid=0 auid=0 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'

Is there any way to disable this messages?

not sure if this is a good thing to do, but you can remove the audit package, and/or add audit=0 as a kernel option in grub.conf.