Red Hat Knowledgebase

Release found : Red Hat Enterprise Linux 3 And 4

laus/auditd service can be disabled on a Red Hat Enterprise Linux 3 system by the following procedure:

1. Stop the cron service

   service crond stop

2. Use the following command to stop the auditd service:

   For Red Hat Enterprise Linux 4:
   # service auditd stop 
   
   For Red Hat Enterprise Linux 3:
   # service audit stop
   # service atd stop 

3. Add the following line to /etc/modules.conf file:

   alias char-major-10-224 off

4. Remove the audit module by using the command :

   rmmod audit

5. Disable the auditd service:

   chkconfig auditd off

6. Reboot the machine.

On Red Hat Enterprise Linux 4 only step 4 is not required, the rest of the process is the same.

To confirm that the service has been disabled run the following command:

chkconfig --list auditd

#chkconfig --list auditd
auditd          0:off   1:off   2:off   3:off   4:off   5:off   6:off

which means that the auditd service is disabled.