Unix auditing

[jillotoole]

Can anyone help me out in shutting off auditing. I currently have a /var/auditing directory which was very large before I deleted it. How can I shut off auditing? I am running SUN OS version 7....

Thanks!

 

[ady2k]

You can check the accounting process in your Sun Server.
And you can turn off / kill the process.
# ps -eaf | grep pacct or acct
I am not sure the process name.
Or you ran tripwire from Sun Server.
Tripwire also can do auditing your Sun System.
Good Luck

 

[Annihilannic]

Check whether you have an auditd process running.

Reading the man it looks like if there is an /etc/security/audit/audit_control file on your system auditing will be enabled. Try moving or removing this file and stop the daemon? Annihilannic.