Audit rules keys

Henning, Arthur C. (CSL) art.henning at ngc.com
Tue Aug 21 15:21:37 UTC 2007


Using system-config-audit getting key (-k) configuration errors when
saving changes.

[root at localhost ~]# Stopping auditd: [  OK  ]
Starting auditd: [  OK  ]
key option needs a watch or syscall given prior to it
There was an error in line 9 of /etc/audit/audit.rules
cat /etc/audit/audit.rules
-e 1
-f 2
-b 8192
-r 0

-D
-a entry,always -S adjtimex -S settimeofday
-a entry,always -S clock_settime
-a entry,always -k kill -S kill
-a exit,always -k system-locale -S sethostname
-a exit,always -F exit=-13 -k creation -S creat -S mkdir -S mknod -S
link -S symlink
-a exit,always -F exit=-13 -k creation -S mkdirat -S mknodat -S linkat
-S symlinkat

If I remove the key from line 9 and save, get error reported line 10,
etc.

Started with NISPOM.rules contrib file.

Art Henning (CSL) 
Enterprise IT Solutions
Northrop Grumman Corp
art.henning at ngc.com





More information about the Linux-audit mailing list