FC4 Problems with auditd

[Paul Howarth]

On Mon, 2005-08-01 at 20:26 +0200, Vassilios Kotoulas wrote:
> hi,
> 
> when auditd starts on boot I get an error message about a syntax error
> in /etc/audit.rules in line 5
> 
> this is the file:
> 
> # This file contains the auditctl rules that are loaded
> # whenever the audit daemon is started via the initscripts.
> #
> # First rule - delete all
> -D
> #
> # Feel free to add below this line. See auditctl man page
> #
> # Increase the buffers to survive stress events
> -b 256
> 
> 
> I can't find -D in the auditctl(8). Is it a remain from fc3? I did an
> update fc3 -> fc4 some days ago. How must the first rule look now?

It's fine.

Have you applied all updates?
Are you not running SELinux in enforcing mode?

See:
https://bugzilla.redhat.com/bugzilla/show_bug.cgi?id=163223

Paul.
-- 
Paul Howarth <paul at city-fan.org>