auditoria do linux repetindo USER_ACCT CRED_ACQ LOGIN USER_START USER_END no cron

Question

meu sistema é SUSE SLES 11.4 x86-64 e o seguinte parece ser gerado a cada minuto. Isso é depois de uma reinicialização do sistema com muito de tudo desligado no chkconfig, incluindo o auditd. Eu começo o auditd manualmente e faço um tail -f /var/log/audit.log e capture o seguinte:

node=shark type=USER_ACCT msg=audit(1476133081.102:283): user pid=9179 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_ACQ msg=audit(1476133081.102:284): user pid=9179 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=LOGIN msg=audit(1476133081.102:285): login pid=9179 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=13
node=shark type=USER_START msg=audit(1476133081.102:286): user pid=9179 uid=0 auid=0 ses=13 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_DISP msg=audit(1476133081.766:287): user pid=9179 uid=0 auid=0 ses=13 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=USER_END msg=audit(1476133081.766:288): user pid=9179 uid=0 auid=0 ses=13 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'


node=shark type=USER_ACCT msg=audit(1476133141.766:289): user pid=9372 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_ACQ msg=audit(1476133141.766:290): user pid=9372 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=LOGIN msg=audit(1476133141.766:291): login pid=9372 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=14
node=shark type=USER_START msg=audit(1476133141.766:292): user pid=9372 uid=0 auid=0 ses=14 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_DISP msg=audit(1476133142.446:293): user pid=9372 uid=0 auid=0 ses=14 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=USER_END msg=audit(1476133142.446:294): user pid=9372 uid=0 auid=0 ses=14 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'


node=shark type=USER_ACCT msg=audit(1476133261.130:307): user pid=9778 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_ACQ msg=audit(1476133261.130:308): user pid=9778 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=LOGIN msg=audit(1476133261.130:309): login pid=9778 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=17
node=shark type=USER_START msg=audit(1476133261.130:310): user pid=9778 uid=0 auid=0 ses=17 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_DISP msg=audit(1476133261.802:311): user pid=9778 uid=0 auid=0 ses=17 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=USER_END msg=audit(1476133261.802:312): user pid=9778 uid=0 auid=0 ses=17 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'


node=shark type=USER_ACCT msg=audit(1476133321.806:313): user pid=9972 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:accounting acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_ACQ msg=audit(1476133321.806:314): user pid=9972 uid=0 auid=4294967295 ses=4294967295 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=LOGIN msg=audit(1476133321.806:315): login pid=9972 uid=0 old auid=4294967295 new auid=0 old ses=4294967295 new ses=18
node=shark type=USER_START msg=audit(1476133321.806:316): user pid=9972 uid=0 auid=0 ses=18 msg='op=PAM:session_open acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=CRED_DISP msg=audit(1476133322.474:317): user pid=9972 uid=0 auid=0 ses=18 msg='op=PAM:setcred acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'
node=shark type=USER_END msg=audit(1476133322.474:318): user pid=9972 uid=0 auid=0 ses=18 msg='op=PAM:session_close acct="root" exe="/usr/sbin/cron" (hostname=?, addr=?, terminal=cron res=success)'

meu arquivo /etc/audit/audit.rules é somente isso

# First rule - delete all
-D

# Increase the buffers to survive stress events.
# Make this bigger for busy systems
-b 8192000

# -f is failure flag, 0=silent, 1=print, 2=panic shutdown
-f 1

# -e is enable context flag, 0=disable, 1=enable, 2=lockdown reboot required
-e 1

Até agora eu encontrei se eu desligar cron via /etc/init.d/cron , então parece que parou as repetidas 6 linhas de saída que estavam acontecendo a cada minuto.

Eu encontrei este artigo: link e a resposta postada foi "Isso surgiu no passado e nós não temos uma boa solução, Nós chutamos a adição de filtragem baseada no contexto do selinux"

Alguém pode lançar alguma luz sobre isso e qual é o melhor curso de ação? Porque isso equivale a um arquivo de log de mais de 100 MB após uma semana e não tem valor agregado.