Displaying 1 result from an estimated 1 matches for "user_tti".
Did you mean:
use_rtti
2010 Jun 27
0
Stop auditd logging all commands
Hello everyone,
I have this box where auditd is logging every command typed on the system
onto: /var/log/audit/audit.log
Every line looks like:
type=USER_TTY msg=audit msg=audit(124433....<snip> msg="command here" ...
The strange thing is that I have other similar boxes and I don't see this
behavior. I don't see any option in /etc/audit/* or any PAM module triggering