Removal of audit rules with audit start

[Steve Grubb]

On Monday 14 February 2005 15:32, Kris Wilson wrote:
> I found that when I stop auditd, any existing audit rules still exist, but
> they are deleted when I restart using audit-0.6.2.  Is this new behavior
> deliberate and preferred?  

Yes. It wasn't done with your test suite in mind, but as a first round attempt 
to solve real production server issues. The preferred way to "reload" rules 
is:

service auditd restart

This means that it terminates the audit daemon, re-runs it, deletes the rules 
and reloads the rules. I'm still looking this over and may tweak it some more 
in the next release. I may make a "reload" target that doesn't stop the 
daemon, but just reloads the auditctl rules. 

I'm not sure a sighup makes sense for this daemon. I'd have to re-architect 
some of it to stop the logging thread and make a new logging thread with new 
config data. I plan to revisit this issue down the road after seeing how the 
current version works out.

> Is there a new option to not delete rules on startup?

No.

> All our tests are stopping and restarting auditd between assertions and
> cleaning out the log file to reduce clutter.  We'll need to change the tests
> if this will no  longer work. 

What I would suggest is commenting out the -D at the top of /etc/audit.rules. 
Or maybe you want many different audit.rules files and your test script swaps 
out the file between "runs".

Thanks,
-Steve Grubb