I recently tried to use auditd to find what's creating tmp files on a CentOS 5 x64 OS. I removed the rules:
# auditctl -l No rules
but there is a lot of writing into auditd logs. If I check the logs using ssh:
# watch ls -la /var/log/audit/
auditd writes 2kb/s. If I check it with samba - it rotates 5MB log file every second. If I check it via ssh and use samba to open a directory - it writes 1 MB each time I open a directory. I'm comparing that to my CentOS 6 server which doesn't write to logs while I'm checking them via ssh. It only writes when I login/logout via ssh.
I haven't changed configuration.
Update: after server restart the auditd is no longer writing that much data. It still writes something, but it doesn't flood. Here is what it's writing now:
type=CRED_DISP msg=audit(1448603110.552:21): user pid=2708 uid=0 auid=0 msg='PAM: setcred acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)' type=USER_END msg=audit(1448603110.552:22): user pid=2708 uid=0 auid=0 msg='PAM: session close acct="root" : exe="/usr/sbin/crond" (hostname=?, addr=?, terminal=cron res=success)'
And there are no rules - auditctl -l shows nothing. Is there anything else than rules that might cause auditd to write in logs?