How to disable kaudit???

[Ed Greshko]

On 09/29/2015 09:35 AM, jd1008 wrote:
>
>
> On 09/28/2015 06:46 PM, Ed Greshko wrote:
>> On 09/29/2015 08:37 AM, jd1008 wrote:
>>> Huge amounts of audit output in /var/log/messages.
>>>
>>> How can we stop it? or completely disable it.
>>>
>> https://lists.fedoraproject.org/pipermail/users/2015-July/463123.html
>>
> # systemctl stop auditd
> Failed to stop auditd.service: Operation refused, unit auditd.service may be requested by dependency only.

It can't be stopped manually once it is started.  Look in the service file to see...

RefuseManualStop=yes
>
> So, which of these services needs to be stoped? disabled? hacked? in order to stop auditd.
> Can it even be disabled without screwing up the system?

If you want to completely disable auditd just do what the link provided tells you....

stick audit=0 on the kernel command line options in grub.cfg, disable the auditd service (or uninstall it).

Others have done it with no ill effects.


-- 
In reality, some people should stick to running Windows and others should stay away from computers altogether.