selinux sandbox not useful [preauth] : 211 time(s)

[Tom Horsley]

On Tue, 25 Dec 2012 04:34:13 +0100
Reindl Harald wrote:

> is it possible on systems with selinux completly disabled to
> get rid of this messages in /var/log/secure everytime a
> ssh-session is opened?

I don't know how to get rid of the source of the message,
but I have discovered the way to keep drivel from cluttering
up the logs:

I create a file named /etc/rsyslog.d/systemd-drivel.conf
which contains patterns like this:

:programname, isequal, "systemd-logind" ~
:msg, contains, "Activating via systemd" ~
:msg, contains, "Activation via systemd failed" ~
:msg, contains, "org.freedesktop.systemd" ~

You ought to be able to do something like:

:msg, contains, "selinux sandbox not useful" ~

in a similar file to get rid of the sandbox messages.
(Note that the trailing tilde characters are part of
the pattern, not some mail artifact :-).