[systemd-devel] Systemd Journald and audit logging causing journal issues

[Lennart Poettering]

On Fr, 01.12.17 12:19, Brad Zynda (bradley.v.zynda at nasa.gov) wrote:

> 
> 
> On 12/01/2017 12:11 PM, Lennart Poettering wrote:
> > On Fr, 01.12.17 09:05, Brad Zynda (bradley.v.zynda at nasa.gov) wrote:
> > 
> >> Hey Lennart,
> > 
> > Heya,
> > 
> >> Just wanted to get your thoughts on this before we break the link..
> > 
> > On what precisely? I am not sure what the original issue is, can you
> > summarize this briefly here?
> 
> Absolutely, here is the previous email chain:

Ah, completely forgot about that thread...

I am still wondering: why does auditd log to the journal (or syslog or
stdout/stderr) at all? It maintains its own log record database to my
knowledge. Moreover, journald is pulls audit data directly from the
kernel anyway, hence there's no need to also push data in from auditd
anyway....

Lennart

-- 
Lennart Poettering, Red Hat