From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: which kernel config is required?
Date: Wed, 24 Oct 2007 10:43:34 -0400
Message-ID: <200710241043.34855.sgrubb@redhat.com>
References: <BLU116-W7AA917E0BBF17ADF8683C859B0@phx.gbl>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="utf-8"
Content-Transfer-Encoding: quoted-printable
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <BLU116-W7AA917E0BBF17ADF8683C859B0@phx.gbl>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday 22 October 2007 22:38:37 MontyRee wrote:
> My kernel is 2.6.19 at Centos 4.x.

That would be unfortunate. I don't use Centos and have no good idea about=
=20
their versioning. But if they've moved to 2.6.19 and the 4.x means RHEL4=20
compatibility, I have a feeling the audit system won't work correctly. Th=
ere=20
were big changes between RHEL4 & 5 that require new audit packages. What=20
does "uname -r" show you?

> and I have selected below kernel menu.
>
> [*] Auditing support                                                   =
   =20
>                               =E2=94=82 =E2=94=82[*]   Enable system-ca=
ll auditing support

You also need to enable file system auditing support in RHEL4 based kerne=
ls.=20
If you have a 2.6.19 based kernel, the user space audit packages will hav=
e to=20
be changed out. The communication between user space and kernel is differ=
ent.

-Steve