What is the purpose of auditctl -a never,task?












0














I see that whenever I start a new ec2 server the default rule for auditctl



is



auditctl -a never,task


What is the purpose of having this rule?










share|improve this question



























    0














    I see that whenever I start a new ec2 server the default rule for auditctl



    is



    auditctl -a never,task


    What is the purpose of having this rule?










    share|improve this question

























      0












      0








      0







      I see that whenever I start a new ec2 server the default rule for auditctl



      is



      auditctl -a never,task


      What is the purpose of having this rule?










      share|improve this question













      I see that whenever I start a new ec2 server the default rule for auditctl



      is



      auditctl -a never,task


      What is the purpose of having this rule?







      amazon-ec2 audit






      share|improve this question













      share|improve this question











      share|improve this question




      share|improve this question










      asked 25 mins ago









      J L

      13




      13






















          1 Answer
          1






          active

          oldest

          votes


















          0














          From man auditctl



            -a [list,action|action,list]

          task Add a rule to the per task list. This rule list is
          used only at the time a task is created -- when
          fork() or clone() are called by the parent task.
          When using this list, you should only use fields
          that are known at task creation time, such as the
          uid, gid, etc.

          never No audit records will be generated. This can be used
          to suppress event generation. In general, you want
          suppressions at the top of the list instead of the
          bottom. This is because the event triggers on the
          first matching rule.


          So this will stop fork() and clone() from generating audit logs, which could otherwise cause extra CPU load and I/O and disk usage.





          share





















            Your Answer








            StackExchange.ready(function() {
            var channelOptions = {
            tags: "".split(" "),
            id: "106"
            };
            initTagRenderer("".split(" "), "".split(" "), channelOptions);

            StackExchange.using("externalEditor", function() {
            // Have to fire editor after snippets, if snippets enabled
            if (StackExchange.settings.snippets.snippetsEnabled) {
            StackExchange.using("snippets", function() {
            createEditor();
            });
            }
            else {
            createEditor();
            }
            });

            function createEditor() {
            StackExchange.prepareEditor({
            heartbeatType: 'answer',
            autoActivateHeartbeat: false,
            convertImagesToLinks: false,
            noModals: true,
            showLowRepImageUploadWarning: true,
            reputationToPostImages: null,
            bindNavPrevention: true,
            postfix: "",
            imageUploader: {
            brandingHtml: "Powered by u003ca class="icon-imgur-white" href="https://imgur.com/"u003eu003c/au003e",
            contentPolicyHtml: "User contributions licensed under u003ca href="https://creativecommons.org/licenses/by-sa/3.0/"u003ecc by-sa 3.0 with attribution requiredu003c/au003e u003ca href="https://stackoverflow.com/legal/content-policy"u003e(content policy)u003c/au003e",
            allowUrls: true
            },
            onDemand: true,
            discardSelector: ".discard-answer"
            ,immediatelyShowMarkdownHelp:true
            });


            }
            });














            draft saved

            draft discarded


















            StackExchange.ready(
            function () {
            StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f491406%2fwhat-is-the-purpose-of-auditctl-a-never-task%23new-answer', 'question_page');
            }
            );

            Post as a guest















            Required, but never shown

























            1 Answer
            1






            active

            oldest

            votes








            1 Answer
            1






            active

            oldest

            votes









            active

            oldest

            votes






            active

            oldest

            votes









            0














            From man auditctl



              -a [list,action|action,list]

            task Add a rule to the per task list. This rule list is
            used only at the time a task is created -- when
            fork() or clone() are called by the parent task.
            When using this list, you should only use fields
            that are known at task creation time, such as the
            uid, gid, etc.

            never No audit records will be generated. This can be used
            to suppress event generation. In general, you want
            suppressions at the top of the list instead of the
            bottom. This is because the event triggers on the
            first matching rule.


            So this will stop fork() and clone() from generating audit logs, which could otherwise cause extra CPU load and I/O and disk usage.





            share


























              0














              From man auditctl



                -a [list,action|action,list]

              task Add a rule to the per task list. This rule list is
              used only at the time a task is created -- when
              fork() or clone() are called by the parent task.
              When using this list, you should only use fields
              that are known at task creation time, such as the
              uid, gid, etc.

              never No audit records will be generated. This can be used
              to suppress event generation. In general, you want
              suppressions at the top of the list instead of the
              bottom. This is because the event triggers on the
              first matching rule.


              So this will stop fork() and clone() from generating audit logs, which could otherwise cause extra CPU load and I/O and disk usage.





              share
























                0












                0








                0






                From man auditctl



                  -a [list,action|action,list]

                task Add a rule to the per task list. This rule list is
                used only at the time a task is created -- when
                fork() or clone() are called by the parent task.
                When using this list, you should only use fields
                that are known at task creation time, such as the
                uid, gid, etc.

                never No audit records will be generated. This can be used
                to suppress event generation. In general, you want
                suppressions at the top of the list instead of the
                bottom. This is because the event triggers on the
                first matching rule.


                So this will stop fork() and clone() from generating audit logs, which could otherwise cause extra CPU load and I/O and disk usage.





                share












                From man auditctl



                  -a [list,action|action,list]

                task Add a rule to the per task list. This rule list is
                used only at the time a task is created -- when
                fork() or clone() are called by the parent task.
                When using this list, you should only use fields
                that are known at task creation time, such as the
                uid, gid, etc.

                never No audit records will be generated. This can be used
                to suppress event generation. In general, you want
                suppressions at the top of the list instead of the
                bottom. This is because the event triggers on the
                first matching rule.


                So this will stop fork() and clone() from generating audit logs, which could otherwise cause extra CPU load and I/O and disk usage.






                share











                share


                share










                answered 8 mins ago









                Stephen Harris

                24.6k24477




                24.6k24477






























                    draft saved

                    draft discarded




















































                    Thanks for contributing an answer to Unix & Linux Stack Exchange!


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.





                    Some of your past answers have not been well-received, and you're in danger of being blocked from answering.


                    Please pay close attention to the following guidance:


                    • Please be sure to answer the question. Provide details and share your research!

                    But avoid



                    • Asking for help, clarification, or responding to other answers.

                    • Making statements based on opinion; back them up with references or personal experience.


                    To learn more, see our tips on writing great answers.




                    draft saved


                    draft discarded














                    StackExchange.ready(
                    function () {
                    StackExchange.openid.initPostLogin('.new-post-login', 'https%3a%2f%2funix.stackexchange.com%2fquestions%2f491406%2fwhat-is-the-purpose-of-auditctl-a-never-task%23new-answer', 'question_page');
                    }
                    );

                    Post as a guest















                    Required, but never shown





















































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown

































                    Required, but never shown














                    Required, but never shown












                    Required, but never shown







                    Required, but never shown







                    Popular posts from this blog

                    Accessing regular linux commands in Huawei's Dopra Linux

                    Can't connect RFCOMM socket: Host is down

                    Kernel panic - not syncing: Fatal Exception in Interrupt