[systemd-devel] Systemd Journald and audit logging causing journal issues

[Lennart Poettering]

On Fr, 01.12.17 09:05, Brad Zynda (bradley.v.zynda at nasa.gov) wrote:

> Hey Lennart,

Heya,

> Just wanted to get your thoughts on this before we break the link..

On what precisely? I am not sure what the original issue is, can you
summarize this briefly here?

> also can you provide proper direction or a howto for breaking the link
> between auditd and journald?

auditd and journald aren't linked. Both get the audit data directly
from the kernel. Either can run fine without the other. To turn off
that journald picks up audit data from the kernel use "systemctl mask
systemd-journald-audit.socket" (and reboot), which will turn off all
audit data collection by journald.

But again, I am not entirely sure what the original issue is?

Lennart

-- 
Lennart Poettering, Red Hat