which kernel config is required?

[Steve Grubb]

On Monday 22 October 2007 22:38:37 MontyRee wrote:
> My kernel is 2.6.19 at Centos 4.x.

That would be unfortunate. I don't use Centos and have no good idea about 
their versioning. But if they've moved to 2.6.19 and the 4.x means RHEL4 
compatibility, I have a feeling the audit system won't work correctly. There 
were big changes between RHEL4 & 5 that require new audit packages. What 
does "uname -r" show you?

> and I have selected below kernel menu.
>
> [*] Auditing support                                                       
>                               │ │[*]   Enable system-call auditing support

You also need to enable file system auditing support in RHEL4 based kernels. 
If you have a 2.6.19 based kernel, the user space audit packages will have to 
be changed out. The communication between user space and kernel is different.

-Steve