Hello,

On certain installations of RHEL ES 3.0 if a full install of the OS was done, a daemon called auditd runs. It acts as a kind of inbetween interface between kernel space and user space.

It uses /dev/audit to talk from the kernel to the auditd daemon. I would like this to stop because in my opinion it has no place on production servers unless the sysadmin is very paraniod about security, or is for some reason kernel debugging on production servers.

Anway, I have stopped the daemon, and removed it from starting up upon reboot.

My question is, what is the proper way to remove the character device /dev/audit without killing my kernel?

thanks in advance
-bleunuit