issue with file watches on Suse 10.1 using latest 2.6.18-rc4 and audit 1.2.3

[Rick Warner]

Hello all,

I am trying to set up file watches for files such as /etc/passwd 
and /etc/shadow.  I am using Suse 10.1.  I have updated the kernel to a 
kernel.org 2.6.18-rc4 kernel, and have updated the audit userspace tools to 
version 1.2.3.  I can add filesystem watches with "auditctl -w /etc/passwd" 
successfully now.  Entries in the audit.log are created. 

The first problem is that when I use "aureport -w", it tells me "<no events of 
interest were found>".  Using "aureport -f" instead, it shows entries 
for /etc/passwd, but the auid column for all results is -1 (or "unset" if 
using the -i option to aureport).  Looking at the audit logfile, 
auid=4294967295 which then correlates to -1 when used as a signed vs unsigned 
int.

How can I fix this?

-- 
Richard Warner
Lead Systems Integrator
Microway, Inc
(508)732-5517