Hello,

while trying to make sense of the remaining C bits in anaconda, I found that we actually have a mock auditd, which does nothing and replaces the real auditd on boot.iso, via lorax templates.

Now I'm trying to understand why. Is it because it writes too much to journal? Is it because it takes 90 MB memory? Something else?

Steve, Brian - would you know?

PS: https://github.com/rhinstaller/anaconda/pull/4331 - moving it from the python module directory where it was hiding.

Best,

Vladimir

--