7:37 p.m.
Huge amounts of audit output in /var/log/messages.
How can we stop it? or completely disable it.
7:46 p.m.
On 09/29/2015 08:37 AM, jd1008 wrote:
Huge amounts of audit output in /var/log/messages.
How can we stop it? or completely disable it.
https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
--
In reality, some people should stick to running Windows and others should stay away from
computers altogether.
8:35 p.m.
On 09/28/2015 06:46 PM, Ed Greshko wrote:
On 09/29/2015 08:37 AM, jd1008 wrote:
> Huge amounts of audit output in /var/log/messages.
>
> How can we stop it? or completely disable it.
>
https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
# systemctl stop auditd
Failed to stop auditd.service: Operation refused, unit auditd.service
may be requested by dependency only.
# grep -Rl auditd /lib/systemd
./system/sysinit.target.wants/systemd-update-utmp.service
./system/crond.service
./system/auditd.service
./system/systemd-update-utmp.service
./system-preset/90-default.preset
So, which of these services needs to be stoped? disabled? hacked? in
order to stop auditd.
Can it even be disabled without screwing up the system?
8:39 p.m.
Well, I erased it, and all my systems work without any apparent issues.
Ranjan
On Mon, 28 Sep 2015 19:35:25 -0600 jd1008 <jd1008(a)gmail.com> wrote:
On 09/28/2015 06:46 PM, Ed Greshko wrote:
> On 09/29/2015 08:37 AM, jd1008 wrote:
>> Huge amounts of audit output in /var/log/messages.
>>
>> How can we stop it? or completely disable it.
>>
> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>
# systemctl stop auditd
Failed to stop auditd.service: Operation refused, unit auditd.service
may be requested by dependency only.
# grep -Rl auditd /lib/systemd
./system/sysinit.target.wants/systemd-update-utmp.service
./system/crond.service
./system/auditd.service
./system/systemd-update-utmp.service
./system-preset/90-default.preset
So, which of these services needs to be stoped? disabled? hacked? in
order to stop auditd.
Can it even be disabled without screwing up the system?
--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
--
Important Notice: This mailbox is ignored: e-mails are set to be deleted on receipt.
Please respond to the mailing list if appropriate. For those needing to send personal or
professional e-mail, please use appropriate addresses.
____________________________________________________________
Send your photos by email in seconds...
TRY FREE IM TOOLPACK at http://www.imtoolpack.com/default.aspx?rc=if3
Works in all emails, instant messengers, blogs, forums and social networks.
8:46 p.m.
On 09/28/2015 07:39 PM, Ranjan Maitra wrote:
Well, I erased it, and all my systems work without any apparent
issues.
Ranjan
On Mon, 28 Sep 2015 19:35:25 -0600 jd1008 <jd1008(a)gmail.com> wrote:
>
> On 09/28/2015 06:46 PM, Ed Greshko wrote:
>> On 09/29/2015 08:37 AM, jd1008 wrote:
>>> Huge amounts of audit output in /var/log/messages.
>>>
>>> How can we stop it? or completely disable it.
>>>
>> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>>
> # systemctl stop auditd
> Failed to stop auditd.service: Operation refused, unit auditd.service
> may be requested by dependency only.
>
> # grep -Rl auditd /lib/systemd
> ./system/sysinit.target.wants/systemd-update-utmp.service
> ./system/crond.service
> ./system/auditd.service
> ./system/systemd-update-utmp.service
> ./system-preset/90-default.preset
>
> So, which of these services needs to be stoped? disabled? hacked? in
> order to stop auditd.
> Can it even be disabled without screwing up the system?
>
>
Ranjan Ji,
I have no idea what you removed (erased).
9:19 p.m.
Ranjan Ji,
I have no idea what you removed (erased).
Sorry, I did not realize that you were unable to follow but please see my first response
to your first post.
--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
--
Important Notice: This mailbox is ignored: e-mails are set to be deleted on receipt.
Please respond to the mailing list if appropriate. For those needing to send personal or
professional e-mail, please use appropriate addresses.
____________________________________________________________
FREE 3D EARTH SCREENSAVER - Watch the Earth right on your desktop!
Check it out at http://www.inbox.com/earth
8:45 p.m.
On 09/29/2015 09:35 AM, jd1008 wrote:
On 09/28/2015 06:46 PM, Ed Greshko wrote:
> On 09/29/2015 08:37 AM, jd1008 wrote:
>> Huge amounts of audit output in /var/log/messages.
>>
>> How can we stop it? or completely disable it.
>>
> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>
# systemctl stop auditd
Failed to stop auditd.service: Operation refused, unit auditd.service may be requested by
dependency only.
It can't be stopped manually once it is started. Look in the service file to see...
RefuseManualStop=yes
So, which of these services needs to be stoped? disabled? hacked? in order to stop
auditd.
Can it even be disabled without screwing up the system?
If you want to completely disable auditd just do what the link provided tells you....
stick audit=0 on the kernel command line options in grub.cfg, disable the auditd service
(or uninstall it).
Others have done it with no ill effects.
--
In reality, some people should stick to running Windows and others should stay away from
computers altogether.
8:48 p.m.
On 09/28/2015 07:45 PM, Ed Greshko wrote:
On 09/29/2015 09:35 AM, jd1008 wrote:
>
> On 09/28/2015 06:46 PM, Ed Greshko wrote:
>> On 09/29/2015 08:37 AM, jd1008 wrote:
>>> Huge amounts of audit output in /var/log/messages.
>>>
>>> How can we stop it? or completely disable it.
>>>
>> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>>
> # systemctl stop auditd
> Failed to stop auditd.service: Operation refused, unit auditd.service may be
requested by dependency only.
It can't be stopped manually once it is started. Look in the service file to see...
RefuseManualStop=yes
> So, which of these services needs to be stoped? disabled? hacked? in order to stop
auditd.
> Can it even be disabled without screwing up the system?
If you want to completely disable auditd just do what the link provided tells you....
stick audit=0 on the kernel command line options in grub.cfg, disable the auditd service
(or uninstall it).
Others have done it with no ill effects.
Too many dependencies! :(
I will reboot and get back to you ....
8:55 p.m.
On 09/29/2015 09:48 AM, jd1008 wrote:
On 09/28/2015 07:45 PM, Ed Greshko wrote:
> On 09/29/2015 09:35 AM, jd1008 wrote:
>>
>> On 09/28/2015 06:46 PM, Ed Greshko wrote:
>>> On 09/29/2015 08:37 AM, jd1008 wrote:
>>>> Huge amounts of audit output in /var/log/messages.
>>>>
>>>> How can we stop it? or completely disable it.
>>>>
>>> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>>>
>> # systemctl stop auditd
>> Failed to stop auditd.service: Operation refused, unit auditd.service may be
requested by dependency only.
> It can't be stopped manually once it is started. Look in the service file to
see...
>
> RefuseManualStop=yes
>> So, which of these services needs to be stoped? disabled? hacked? in order to
stop auditd.
>> Can it even be disabled without screwing up the system?
> If you want to completely disable auditd just do what the link provided tells
you....
>
> stick audit=0 on the kernel command line options in grub.cfg, disable the auditd
service (or uninstall it).
>
> Others have done it with no ill effects.
>
>
Too many dependencies! :(
Really?
[root@f22g ~]# dnf erase audit
Dependencies resolved.
==================================================================================
Package Arch Version Repository Size
==================================================================================
Removing:
audit x86_64 2.4.4-1.fc22 @System 625 k
setroubleshoot x86_64 3.2.24-2.fc22 @System 235 k
setroubleshoot-plugins noarch 3.0.61-1.fc22 @System 5.1 M
setroubleshoot-server x86_64 3.2.24-2.fc22 @System 1.2 M
Transaction Summary
==================================================================================
Remove 4 Packages
--
In reality, some people should stick to running Windows and others should stay away from
computers altogether.
9:03 p.m.
On 09/28/2015 07:55 PM, Ed Greshko wrote:
On 09/29/2015 09:48 AM, jd1008 wrote:
>
> On 09/28/2015 07:45 PM, Ed Greshko wrote:
>> On 09/29/2015 09:35 AM, jd1008 wrote:
>>> On 09/28/2015 06:46 PM, Ed Greshko wrote:
>>>> On 09/29/2015 08:37 AM, jd1008 wrote:
>>>>> Huge amounts of audit output in /var/log/messages.
>>>>>
>>>>> How can we stop it? or completely disable it.
>>>>>
>>>> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>>>>
>>> # systemctl stop auditd
>>> Failed to stop auditd.service: Operation refused, unit auditd.service may be
requested by dependency only.
>> It can't be stopped manually once it is started. Look in the service file to
see...
>>
>> RefuseManualStop=yes
>>> So, which of these services needs to be stoped? disabled? hacked? in order to
stop auditd.
>>> Can it even be disabled without screwing up the system?
>> If you want to completely disable auditd just do what the link provided tells
you....
>>
>> stick audit=0 on the kernel command line options in grub.cfg, disable the auditd
service (or uninstall it).
>>
>> Others have done it with no ill effects.
>>
>>
> Too many dependencies! :(
Really?
[root@f22g ~]# dnf erase audit
Dependencies resolved.
==================================================================================
Package Arch Version Repository Size
==================================================================================
Removing:
audit x86_64 2.4.4-1.fc22 @System 625 k
setroubleshoot x86_64 3.2.24-2.fc22 @System 235 k
setroubleshoot-plugins noarch 3.0.61-1.fc22 @System 5.1 M
setroubleshoot-server x86_64 3.2.24-2.fc22 @System 1.2 M
Transaction Summary
==================================================================================
Remove 4 Packages
Because of habit, I used yum instead of dnf. But I thought I should erase
4 or 5 packages whose names included the word audit, such as
yum erase audit-libs-python audit-libs audit-libs-devel audit
and that belched out tons of dependencies.
The link you mentioned did not tell me how to erase.
Thanks for the heads up.
1:33 p.m.
On 09/28/2015 07:55 PM, Ed Greshko wrote:
dnf erase audit
After running dnf erase audit (several days
ago),
I am still getting tons of audit messages.
So, I thought that perhaps the command had not succeeded. I reran:
# dnf erase audit
No match for argument: audit
Error: No packages marked for removal.
Here is a small sample of audit messages:
[ 5325.515636] audit: type=1103 audit(1444760702.331:519): pid=23219
uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred
grantors=pam_env,pam_unix acct="pcp" exe="/usr/sbin/crond" hostname=?
addr=? terminal=cron res=success'
[ 5325.517632] audit: type=1006 audit(1444760702.333:520): pid=23219
uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023 old-auid=4294967295
auid=982 old-ses=4294967295 ses=7 res=1
[ 5325.598820] audit: type=1101 audit(1444760702.415:521): pid=23222
uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="pcp"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 5325.601527] audit: type=1105 audit(1444760702.417:522): pid=23222
uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='op=PAM:session_open
grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix acct="pcp"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 5325.710879] audit: type=1130 audit(1444760702.527:523): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=user@982 comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'
[ 5325.713158] audit: type=1105 audit(1444760702.529:524): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:session_open
grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
[ 5325.713964] audit: type=1110 audit(1444760702.530:525): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:setcred grantors=pam_env,pam_unix acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
[ 5326.295285] audit: type=1104 audit(1444760703.111:526): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:setcred grantors=pam_env,pam_unix acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
[ 5326.300074] audit: type=1106 audit(1444760703.116:527): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:session_close
grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
1:42 p.m.
On 10/13/2015 11:33 AM, jd1008 wrote:
On 09/28/2015 07:55 PM, Ed Greshko wrote:
> dnf erase audit
After running dnf erase audit (several days ago),
I am still getting tons of audit messages.
So, I thought that perhaps the command had not succeeded. I reran:
# dnf erase audit
No match for argument: audit
Error: No packages marked for removal.
If you haven't stopped audit, or rebooted, it's still active. HTH, HAND.
2:08 p.m.
On 10/13/2015 12:42 PM, Joe Zeff wrote:
On 10/13/2015 11:33 AM, jd1008 wrote:
> On 09/28/2015 07:55 PM, Ed Greshko wrote:
>> dnf erase audit
> After running dnf erase audit (several days ago),
> I am still getting tons of audit messages.
> So, I thought that perhaps the command had not succeeded. I reran:
> # dnf erase audit
> No match for argument: audit
> Error: No packages marked for removal.
If you haven't stopped audit, or rebooted, it's still active. HTH, HAND.
Have rebooted many times.
Stopped it several times ....etc.
1:43 p.m.
On 10/13/2015 12:33 PM, jd1008 wrote:
On 09/28/2015 07:55 PM, Ed Greshko wrote:
> dnf erase audit
After running dnf erase audit (several days ago),
I am still getting tons of audit messages.
So, I thought that perhaps the command had not succeeded. I reran:
# dnf erase audit
No match for argument: audit
Error: No packages marked for removal.
Here is a small sample of audit messages:
[ 5325.515636] audit: type=1103 audit(1444760702.331:519): pid=23219
uid=0 auid=4294967295 ses=4294967295
subj=system_u:system_r:crond_t:s0-s0:c0.c1023 msg='op=PAM:setcred
grantors=pam_env,pam_unix acct="pcp" exe="/usr/sbin/crond" hostname=?
addr=? terminal=cron res=success'
[ 5325.517632] audit: type=1006 audit(1444760702.333:520): pid=23219
uid=0 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
old-auid=4294967295 auid=982 old-ses=4294967295 ses=7 res=1
[ 5325.598820] audit: type=1101 audit(1444760702.415:521): pid=23222
uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='op=PAM:accounting grantors=pam_unix,pam_localuser acct="pcp"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 5325.601527] audit: type=1105 audit(1444760702.417:522): pid=23222
uid=0 auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='op=PAM:session_open
grantors=pam_keyinit,pam_limits,pam_systemd,pam_unix acct="pcp"
exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
[ 5325.710879] audit: type=1130 audit(1444760702.527:523): pid=1 uid=0
auid=4294967295 ses=4294967295 subj=system_u:system_r:init_t:s0
msg='unit=user@982 comm="systemd" exe="/usr/lib/systemd/systemd"
hostname=? addr=? terminal=? res=success'
[ 5325.713158] audit: type=1105 audit(1444760702.529:524): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:session_open
grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
[ 5325.713964] audit: type=1110 audit(1444760702.530:525): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:setcred grantors=pam_env,pam_unix acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
[ 5326.295285] audit: type=1104 audit(1444760703.111:526): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:setcred grantors=pam_env,pam_unix acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
[ 5326.300074] audit: type=1106 audit(1444760703.116:527): pid=23219
uid=0 auid=982 ses=7 subj=system_u:system_r:crond_t:s0-s0:c0.c1023
msg='op=PAM:session_close
grantors=pam_loginuid,pam_keyinit,pam_limits,pam_systemd acct="pcp"
exe="/usr/sbin/crond" hostname=? addr=? terminal=cron res=success'
I wonder if /etc/auditlibs.conf (which on the face of it at least) seem
to be
related to system audit : I tried to remove it (it is installed by erase
audit-libs-2.4.4-1.fc22.x86_64):
# dnf erase audit-libs-2.4.4-1.fc22.x86_64
Dependencies resolved.
Error: The operation would result in removing the following protected
packages: systemd, dnf.
So, why in tarnation are dnf and systemd dependent on the audit???
Is this not also a totally unnecessary intrusion??
If fedora wants to log and monitor all user's activities, why not make
all such
packages dependent on each other so we cannot remove any of them -
which would quickly result in all savvy people to abandon fedora and
similarly
minded distros altogether.
1:46 p.m.
On Tue, 13 Oct 2015 12:33:00 -0600
jd1008 wrote:
I am still getting tons of audit messages.
Adding audit=0 to the kernel command line args in grub.cfg
will definitely eradicate audit (unless someone decides they
just have to change the kernel option which, naturally, happens
constantly in the open source world :-).
7:49 p.m.
What exactly is kaudit?
$ sudo dnf info kaudit
Last metadata expiration check performed 0:04:46 ago on Mon Sep 28 19:43:12 2015.
Error: No matching Packages to list
Anyway, I have done:
dnf erase audit
No major issues so far (since F22 came out).
Ranjan
On Mon, 28 Sep 2015 18:37:59 -0600 jd1008 <jd1008(a)gmail.com> wrote:
Huge amounts of audit output in /var/log/messages.
How can we stop it? or completely disable it.
--
users mailing list
users(a)lists.fedoraproject.org
To unsubscribe or change subscription options:
https://admin.fedoraproject.org/mailman/listinfo/users
Fedora Code of Conduct: http://fedoraproject.org/code-of-conduct
Guidelines: http://fedoraproject.org/wiki/Mailing_list_guidelines
Have a question? Ask away: http://ask.fedoraproject.org
--
Important Notice: This mailbox is ignored: e-mails are set to be deleted on receipt.
Please respond to the mailing list if appropriate. For those needing to send personal or
professional e-mail, please use appropriate addresses.
____________________________________________________________
FREE 3D EARTH SCREENSAVER - Watch the Earth right on your desktop!
Check it out at http://www.inbox.com/earth
3111
days inactive
3125
days old
16 comments
5 participants
participants (5)
-
Ed Greshko -
JD -
Joe Zeff -
Ranjan Maitra -
Tom Horsley