stop auditd on redhat/centos

threatstack · Feb 11, 2019 · 78e5acf · 78e5acf
1 parent c99c322
commit 78e5acf
Showing 1 changed file with 3 additions and 1 deletion.
diff --git a/tasks/main.yml b/tasks/main.yml
@@ -8,7 +8,9 @@
 
 - name: Disable auditd service
   include: disable_auditd.yml
-  when: ansible_distribution == 'Amazon'
+  when:
+    - ansible_os_family == 'RedHat'
+    - (ansible_distribution != 'Amazon' or ansible_kernel is search("\.amzn2\."))
 
 - name: Run Apt configure and install Threat Stack
   include: apt_install.yml