On Fr, 01.12.17 09:05, Brad Zynda ([email protected]) wrote: > Hey Lennart,
Heya, > Just wanted to get your thoughts on this before we break the link.. On what precisely? I am not sure what the original issue is, can you summarize this briefly here? > also can you provide proper direction or a howto for breaking the link > between auditd and journald? auditd and journald aren't linked. Both get the audit data directly from the kernel. Either can run fine without the other. To turn off that journald picks up audit data from the kernel use "systemctl mask systemd-journald-audit.socket" (and reboot), which will turn off all audit data collection by journald. But again, I am not entirely sure what the original issue is? Lennart -- Lennart Poettering, Red Hat _______________________________________________ systemd-devel mailing list [email protected] https://lists.freedesktop.org/mailman/listinfo/systemd-devel
