On May 5, 2016 6:03 AM, "Tony Evans" <gnomt...@gmail.com> wrote: >
> I can't find why the log entries are being created (i.e. I know the > trigger, but I can't work out why that trigger is now generating log > entries when it wasn't doing that before I installed and removed > auditd). > I'm guessing the removal script didn't delete the audit rules which reside in kernel memory. If I'm correct, a reboot will fix this. I'd probably consider that a bug (if I'm right) and confirm and submit a report to the maintainer.
