Debian 11

ktpmm17 · 03-13-2023, 08:23 AM

I'm on a Debian 11 server and my audit logs are going into /var/log/audit/audit.log as well as in /var/log/auth.log. Needless to say, they are filling up my auth.log.... Below are my configs:

/etc/rsyslog.conf
kern.debug /var/log/kern.log
daemon.* /var/log/daemon.log
*.info;cron,auth,authpriv.none /var/log/syslog
cron.* /var/log/cron.log
user.* /var/log/user.log
auth,authpriv.* /var/log/auth.log

/etc/audit/auditd.conf
log_file = /var/log/audit.log

I'm at a bit of a loss here as to what to do. How do I get my audit logs to send to /var/log/audit/audit.log only?

tmick · 03-23-2023, 12:57 PM

Have you tried editing auditd.conf?

ktpmm17 · 03-23-2023, 01:19 PM

Yes, auditd.conf is set to log to /var/log/audit/audit.log

tmick · 03-23-2023, 01:41 PM

could you point the auth logs to the audit log?

ktpmm17 · 03-27-2023, 01:39 PM

We really don't want that. We are trying to get only auth logs in auth.log (which works) and audit logs in audit.log (currently they go into audit.log and auth.log).

tmick · 03-27-2023, 02:05 PM

My guess is contacting Audit's devs and see if they have any suggestions. I'd be surprised if there a configuration setting somewhere that isn't documented well.

ktpmm17 · 03-28-2023, 04:25 AM

Good idea. Any idea where/how I'd find them? Searched for auditd forums and on github with no luck.

tmick · 03-28-2023, 11:26 AM

https://people.redhat.com/sgrubb/audit/ is what synaptic says for a homepage

spiralarms · 06-26-2023, 11:37 AM

Quote:

Originally Posted by ktpmm17

I'm on a Debian 11 server and my audit logs are going into /var/log/audit/audit.log as well as in /var/log/auth.log. Needless to say, they are filling up my auth.log....

I'm at a bit of a loss here as to what to do. How do I get my audit logs to send to /var/log/audit/audit.log only?

Did you ever get a solution to this? I seem to be in the same boat, but running Ubuntu 20.04.6. My config is similar to yours.

Thanks,

Neil

spiralarms · 07-04-2023, 03:12 AM

Quote:

Originally Posted by spiralarms

Did you ever get a solution to this? I seem to be in the same boat, but running Ubuntu 20.04.6. My config is similar to yours.

Replying to my own question. What seems to have worked for us is:

systemctl mask systemd-journald-audit.socket

Neil