How to prevent a Splunk forwarder from passing passwords from auditd?

[gregcain]

I've got a Splunk forwarder installed on a server. This server is also logging its commands via auditd.

When I do something like sudo su -, auditd captures the output, but doesn't expose passwords. An example:

type=USER_AUTH msg=audit(1469642237.076:4664554): user pid=29165 uid=565 auid=565 ses=225532 msg='op=PAM:authentication acct="ME" exe="/usr/bin/sudo" hostname=? addr=? terminal=/dev/pts/14 res=failed'

However, the Splunk forwarder gives much more information, including the password you type on the command line. This is a pretty straight forward install of the forwarder - no fancy stuff going on. How can I use the Splunk forwarder without exposing users' passwords, like auditd does?

Thanks in advance.

[gregcain]

That's the behavior I expected, but the audits logs have the sensitive information removed, whereas the splunk logs have it. I couldn't find a log file on the server that had the sensitive information.