From 940ed980b3fe70c26301ff03f0e2328b965f0265 Mon Sep 17 00:00:00 2001 From: Christoph <43646576+z-bsod@users.noreply.github.com> Date: Mon, 27 Oct 2025 22:23:39 +0100 Subject: [PATCH] disable systemd audit logging (#902) * os_hardening: disable systemd audit logging disable audit logging via systemd-journald when enabling auditd as this leads to duplicate logs in the journal or even /var/log/messages depending on the configuration Signed-off-by: Christoph Sieber * Don't disable systemd-journald-audit.socket on Suse it seems the socket doesn't exist on this OS Signed-off-by: Christoph Sieber --------- Signed-off-by: Christoph Sieber Co-authored-by: Christoph Sieber --- roles/os_hardening/handlers/main.yml | 5 +++++ roles/os_hardening/tasks/auditd.yml | 12 ++++++++++++ 2 files changed, 17 insertions(+) diff --git a/roles/os_hardening/handlers/main.yml b/roles/os_hardening/handlers/main.yml index 864a7531..37e5dcdd 100644 --- a/roles/os_hardening/handlers/main.yml +++ b/roles/os_hardening/handlers/main.yml @@ -27,3 +27,8 @@ path: "{{ item }}" state: remounted loop: "{{ mountpoints_changed }}" + +- name: Restart journald + ansible.builtin.systemd: + name: systemd-journald.service + state: restarted diff --git a/roles/os_hardening/tasks/auditd.yml b/roles/os_hardening/tasks/auditd.yml index 82357570..418fdbce 100644 --- a/roles/os_hardening/tasks/auditd.yml +++ b/roles/os_hardening/tasks/auditd.yml @@ -16,3 +16,15 @@ - Restart auditd via service - Restart auditd via systemd tags: auditd + +- name: Disable systemd-journald.audit + when: + - ansible_facts.os_family != 'Suse' # socket doesn't seem to exist on suse + ansible.builtin.systemd: + name: systemd-journald-audit.socket + state: stopped + enabled: false + masked: true + notify: + - Restart journald + tags: auditd