diff -ur audit.orig/init.d/audit.rules audit/init.d/audit.rules --- audit.orig/init.d/audit.rules 2014-07-20 10:43:44.724841702 -0400 +++ audit/init.d/audit.rules 2014-07-22 14:55:50.856253189 -0400 @@ -6,9 +6,8 @@ # First rule - delete all -D -# Increase the buffers to survive stress events. -# Make this bigger for busy systems --b 320 - -# Feel free to add below this line. See auditctl man page +# This suppresses syscall auditing for all tasks started +# with this rule in effect. Remove it if you need syscall +# auditing. +-a task,never