this option is enabled by default, it is disabled in all others.</para></listitem>
</varlistentry>
+ <varlistentry>
+ <term><varname>Audit=</varname></term>
+
+ <listitem><para>Takes a boolean value. If enabled <command>systemd-journal</command> will turn on
+ kernel auditing on start-up. If disabled it will turn it off. If unset it will neither enable nor
+ disable it, leaving the previous state unchanged. Note that this option does not control whether
+ <command>systemd-journald</command> collects generated audit records, it just controls whether it
+ tells the kernel to generate them. This means if another tool turns on auditing even if
+ <command>systemd-journald</command> left it off, it will still collect the generated
+ messages. Defaults to on.</para></listitem>
+ </varlistentry>
+
<varlistentry>
<term><varname>TTYPath=</varname></term>
if (r < 0)
return log_error_errno(r, "Failed to add audit fd to event loop: %m");
- /* We are listening now, try to enable audit */
- r = enable_audit(s->audit_fd, true);
- if (r < 0)
- log_warning_errno(r, "Failed to issue audit enable call: %m");
+ if (s->set_audit >= 0) {
+ /* We are listening now, try to enable audit if configured so */
+ r = enable_audit(s->audit_fd, s->set_audit);
+ if (r < 0)
+ log_warning_errno(r, "Failed to issue audit enable call: %m");
+ else if (s->set_audit > 0)
+ log_debug("Auditing in kernel turned on.");
+ else
+ log_debug("Auditing in kernel turned off.");
+ }
return 0;
}
Journal.Compress, config_parse_compress, 0, offsetof(Server, compress)
Journal.Seal, config_parse_bool, 0, offsetof(Server, seal)
Journal.ReadKMsg, config_parse_bool, 0, offsetof(Server, read_kmsg)
+Journal.Audit, config_parse_tristate, 0, offsetof(Server, set_audit)
Journal.SyncIntervalSec, config_parse_sec, 0, offsetof(Server, sync_interval_usec)
# The following is a legacy name for compatibility
Journal.RateLimitInterval, config_parse_sec, 0, offsetof(Server, ratelimit_interval)
.compress.threshold_bytes = (uint64_t) -1,
.seal = true,
+ .set_audit = true,
+
.watchdog_usec = USEC_INFINITY,
.sync_interval_usec = DEFAULT_SYNC_INTERVAL_USEC,
JournalCompressOptions compress;
bool seal;
bool read_kmsg;
+ int set_audit;
bool forward_to_kmsg;
bool forward_to_syslog;
#MaxLevelWall=emerg
#LineMax=48K
#ReadKMsg=yes
+#Audit=yes