Hello everyone,

I have this box where auditd is logging every command typed on the system onto: /var/log/audit/audit.log

Every line looks like: type=USER_TTY msg=audit msg=audit(124433....<snip> msg="command here" ...

The strange thing is that I have other similar boxes and I don't see this behavior. I don't see any option in /etc/audit/* or any PAM module triggering it. Is there a way to stop this? I don't want to stop the service since "setroubleshoot" needs it. Any ideas?

Thanks! Jorge