auditd without a logfile?
Is there anyway to run auditd without any local logging? I'm trying to see if I can get auditd to completely avoid logging locally, using only a custom dispatcher to log events remotely but auditd refuses to start if I set log_file = '/dev/null'.
Cheers,
peter
Quoted 4 lines · Peter Moody
Is there anyway to run auditd without any local logging? I'm trying to see if I can get auditd to completely avoid logging locally, using only a custom dispatcher to log events remotely but auditd refuses to start if I set
log_file= '/dev/null'.
log_format = NOLOG
-Steve