vmtools generate lots of logs

After installing the vmtools on VM, audit log records lots of weird log like ls, sleep, flock. How do I filter it on audit log setting? The VM is under ubuntu24.04 CIS which means will record most of logs in audit log.

Please find the attach log capture.

The Sangfor HCI platform cannot audit the commands entered inside the VM after installing the vmTools, so the audit logs for commands like "ls," "sleep," and "flock" generated by Sangfor vmTools inside the VM are not captured or filtered by the HCI system itself.

Since your Ubuntu 24.04 VM is configured with CIS audit logging, the audit logs inside the VM are controlled by the VM's own auditd or similar Linux audit system. To filter out specific commands such as "ls," "sleep," and "flock" from the audit logs on the Ubuntu VM, you need to adjust the audit rules inside the VM itself, typically by modifying the auditd configuration (e.g., /etc/audit/audit.rules or /etc/audit/rules.d/) to exclude or ignore those commands.

In summary, filtering these specific command logs is done within the Ubuntu VM's audit configuration, not through Sangfor HCI or vmTools settings.

——The above was generated by an AI assistant (Sangfor Solvia). Need answers even faster next time? Skip the wait and ping Solvia directly — 24/7, no queue, no judgment.

Hi, can u share what's the output of the logs so we can discuss further? is the logs in HCI on the logs in VM itself?