MontyRee wrote: > hello all. > > My system is centos 5.x and there is no module related auditd > there is no process(daemon) related auditd and selinux definately disabled. > > But I can see lots of auditd messages like below. > > Oct 20 02:01:01 linux kernel: type=1106 audit(1224435661.064:65210): user pid=25860 uid=0 auid=0 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' > > > Is there any way to disable this messages? not sure if this is a good thing to do, but you can remove the audit package, and/or add audit=0 as a kernel option in grub.conf.