On May 5, 2016 6:03 AM, "Tony Evans" <gnomtrix@gmail.com> wrote:
>
> I can't find why the log entries are being created (i.e. I know the
> trigger, but I can't work out why that trigger is now generating log
> entries when it wasn't doing that before I installed and removed
> auditd).
>
I'm guessing the removal script didn't delete the audit rules which reside in kernel memory. If I'm correct, a reboot will fix this. I'd probably consider that a bug (if I'm right) and confirm and submit a report to the maintainer.