Home / server / Questions / 855805
Accepted
Mitar
Asked: 2017-06-15 08:13:33 +0800 CST

How to prevent logging USER_AUTH and USER_LOGIN events with auditd

  • 772

I am trying to log changes to a file system using auditd, but I am seeing also many other things being logged, for example all failed SSH logging attempts (USER_AUTH and USER_LOGIN events). How can I prevent them from being logged? When I do auditctl -l I see only the path watching rules and no other rules.

auditd

2 Answers

  1. Best Answer

    For things you don't want in the audit logs, you can add them to an exclude filter. So if you want to exclude logins, you can do

    [root@finch jenny]# auditctl -a exclude,never -F msgtype=USER_AUTH
[root@finch jenny]# auditctl -a exclude,never -F msgtype=LOGIN

    will stop logging of all logins, successful or not. For more information about how to create these rules, see the man page for auditctl.

    However, you might simply use aureport to search for the logs you do want, instead of blocking the ones you don't.

    • 2

  2. I think you will find these events coming out of the pam system. Perhaps there is an option in pam that prevents it from auditing.

    • 0