Resolved How to stop all these audit messages?

[tkalfaoglu]

Server operating system version

Alma Linux 8.8

Plesk version and microupdate number

Obsidian

On AlmaLinux 8.8, the journalctl -f shows these messages arriving every second..

May 27 07:27:02 storm.kalfaoglu.net kernel: kauditd_printk_skb: 27 callbacks suppressed
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1130 audit(1685161622.605:37852006): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='
unit=user-runtime-dir@10291 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1101 audit(1685161622.610:37852007): pid=65259 uid=0 auid=4294967295 ses=4294967295 m
sg='op=PAM:accounting grantors=pam_unix acct="mk" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1006 audit(1685161622.610:37852008): pid=65259 uid=0 old-auid=4294967295 auid=10291 t
ty=(none) old-ses=4294967295 ses=28070 res=1
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1300 audit(1685161622.610:37852008): arch=c000003e syscall=1 success=yes exit=5 a0=8
a1=7ffd8dfe91b0 a2=5 a3=7ffd8dfe8ed3 items=0 ppid=1 pid=65259 auid=10291 uid=0 gid=0 euid=0 suid=0 fsuid=0 egid=0 sgid=0 fsgid=0 tty=(none) s
es=28070 comm="(systemd)" exe="/usr/lib/systemd/systemd" key=(null)
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1327 audit(1685161622.610:37852008): proctitle="(systemd)"
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1105 audit(1685161622.613:37852009): pid=65259 uid=0 auid=10291 ses=28070 msg='op=PAM
:session_open grantors=pam_selinux,pam_selinux,pam_loginuid,pam_namespace,pam_keyinit,pam_limits,pam_systemd,pam_unix acct="mk" exe="/usr/lib
/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1130 audit(1685161622.680:37852010): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='
unit=user@10291 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1105 audit(1685161622.681:37852011): pid=65256 uid=48 auid=4294967295 ses=4294967295
msg='op=PAM:session_open grantors=pam_systemd acct="mk" exe="/usr/sbin/suexec" hostname=? addr=? terminal=? res=success'
May 27 07:27:02 storm.kalfaoglu.net kernel: audit: type=1106 audit(1685161622.682:37852012): pid=65256 uid=48 auid=4294967295 ses=4294967295
msg='op=PAM:session_close grantors=pam_systemd acct="mk" exe="/usr/sbin/suexec" hostname=? addr=? terminal=? res=success'
May 27 07:27:03 storm.kalfaoglu.net kernel: audit: type=1130 audit(1685161623.311:37852013): pid=1 uid=0 auid=4294967295 ses=4294967295 msg='
unit=user-runtime-dir@10342 comm="systemd" exe="/usr/lib/systemd/systemd" hostname=? addr=? terminal=? res=success'

if you notice, these are generated in 1 second!

How can I stop all this useless logging?

 

[tkalfaoglu]

Solved - I changed write_logs to no in /etc/audit/auditd.conf