https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56415#M1885 <P>Are these messages being generated from syscall rules or file system rules? If you are using a syscall rule, you can use the -F switch and exclude the uid of the Splunk user.</P> <P>The other option is to just have Splunk route those events to the nullQueue.</P> <P>Craig</P> Sat, 09 Mar 2013 00:12:02 GMT responsys_cm 2013-03-09T00:12:02Z https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56414#M1884 <P>We are required to monitor /var/log/audit. Whenever splunkd accesses audit.log a new event is created. We are getting close to ten thousand of these messages per hour. I have tried to create an excpetion in audit.rules, however there does not seem to be a good hook, that won't affect legitimate audit.log access events. Any ideas how to solve this issue?</P> Sat, 09 Mar 2013 00:02:49 GMT https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56414#M1884 criscollins 2013-03-09T00:02:49Z https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56415#M1885 <P>Are these messages being generated from syscall rules or file system rules? If you are using a syscall rule, you can use the -F switch and exclude the uid of the Splunk user.</P> <P>The other option is to just have Splunk route those events to the nullQueue.</P> <P>Craig</P> Sat, 09 Mar 2013 00:12:02 GMT https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56415#M1885 responsys_cm 2013-03-09T00:12:02Z https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56416#M1886 <P>splunk runs as root. </P> Thu, 29 Sep 2016 19:44:30 GMT https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56416#M1886 tmacdonagh 2016-09-29T19:44:30Z https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56417#M1887 <P>Removed my previous bad answer. The proper line to be entered into your audit.rules file is </P> <P><CODE>-a exit,never -F path=/opt/splunkforwarder/bin/splunkd -k splunk_exclude</CODE></P> Thu, 20 Oct 2016 21:23:44 GMT https://community.splunk.com/t5/Deployment-Architecture/auditd-splunkd/m-p/56417#M1887 tmacdonagh 2016-10-20T21:23:44Z