(In reply to Howard Guo from comment #5) > Thanks Tony. > > Regarding the auditd.service - > > I not only have auditd.service disabled, but masked. But thanks to systemd, > after a system reboot, kernel audit logs appear from all origins - ssh, > login, opera browser, etc. This might be worth another bug report. What do you mean "but thanks to systemd". A simple reboot isn't going to produce what you state above. Also, as I've said before I need to see logfiles and more detail on changes. Please use the bugzilla attachment feature. Also attach your supportconfig. Please do not open another bugzilla as that's just going to get confusing.