Hello.
I am setting up a new server, but I am running into an issue on my audit file. I have a strict list of items that must be audited, and I have copied that list from a working RHEL 6.1 server. Auditing should be identical, BUT...
I am seeing an excessive amount of entries in my audits, almost all stemming from ~me/.gconf/ folder. When this happens every few minutes, i get a spam of nearly 100 entries telling me that assorted files all have been changed.

.gconf/system/networking/connections/1/ipv4/%gconf.xml
.gconf/system/networking/connections/1/ipv4/%gconf.xml.new
.gconf/system/networking/connections/1/802-3-ethernet/%gconf.xml
.gconf/apps/nm-applet/ignore-ca-cert/%gconf.xml


It is set to report when files are chown, deleted, chmod, etc.
Whatever is going on here, it is done by the PID# of gconfd-2. I cannot disable this process -- I run gnome and weird things happen when i kill it.

If i kill the process and let it sit like that, these actions never show up in the audit. Once i start it again, it continues throwing these errors every few minutes.

These do not get thrown on a similarly configured server -- just this one. Any suggestions?

Edit:Quick update -- its every 5 minutes.

you are running Gnome on a server ?
the ~./gconf files are updated every time you log in as that user

so they will change

the ipv4 and 801 wireless are just updating
probably on the 350 sec. default cycle

Yes, GNOME on a server. I have people logging in through thin clients, using it as a workstation.

I am sure hundreds of files are updated every minute or whatever on Linux. Any ideas what is making gconf special, as far as audits are concerned?

I have a ton of entries in my audit list, but i got around to commenting them out, and waiting the 5 minutes and seeing if the error got pushed or not. I have limited it down to
"-a always,exit -F arch=b64 -S creat -S open -S openat -S truncate -S ftruncate -F exit=-EPERM -F auid>=500 -F auid!=<bignumber> -k access"

So, thats the line. It is on both redhat servers, but only 1 server is reporting the changes every 5 minutes.
Changes are reported for any logged in user -- if i have 3 terminal sessions open to 3 users, then all will get the messages every 5 min.

Any ideas here?
I am getting it on a fresh install as well...just copied the audit rules across.

you could start by turning off the DESKTOP services
a server is not a desktop install

if you do not have a home wireless router or printer or mouse on the server rack then you can turn that off .

If no Bluetooth is being used on the rack ,turn off the desktop Bluetooth daemon
Turn off the gnome screensaver - not needed on a server .
Turn off the "personal file sharing " for the files in the ~/Downloads

open up " gnome-control-center" and disable the desktop programs