[CentOS] Kernel Audit Messages

Mon Oct 17 21:09:38 UTC 2005
Marcin Godlewski <godo at politechnika.lublin.pl>

Kirk Bocek napisał(a):
> Since updating to 4.2 my Opteron server has been flooded by messages like:
> 
> audit(1129565701.837:155): user pid=4700 uid=0 auid=4294967295 msg='PAM
> session open: user=root exe="/usr/sbin/crond" (hostname=?, addr=?,
> terminal=cron result=Success)'
> 
> to both /var/log/messages and the kernel ring buffer. Looks like they
> are being generated by cron jobs being run on the server.
> 
> Does anyone know how to turn these messages off or to redirect them?
> 
I have exactly the same problem. I've solved this by change in
syslog.conf to look like:
*.info;mail.none;authpriv.none;cron.none;auth.!=info
/var/log/messages
and adding this line
 auth.info                                               /var/log/cron.auth

It solved my problem byt its temporally, dont know what to do exactly to
 stop it.


-- 
** WWW: http://www.godlewski.info/ * PGP ID: 12A9EC03 **
** JID: godo at jabber.atman.pl     *     GG: 366328 *   **