From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Result of auditctl -s
Date: Mon, 10 Apr 2017 16:23:14 -0400
Message-ID: <11937388.lkesVPuYIW@x2>
References: <CAJdJdQmL_JaQcui_GrCOXeDhHq7_1Gz+n6fiSh-PO3eZbZ9kgw@mail.gmail.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <CAJdJdQmL_JaQcui_GrCOXeDhHq7_1Gz+n6fiSh-PO3eZbZ9kgw@mail.gmail.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: "warron.french" <warron.french@gmail.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Monday, April 10, 2017 4:20:37 PM EDT warron.french wrote:
> Hi can someone tell me what I need to do, if anything, about failure:  1
> after executing *auditctl -s* please?

auditctl also takes a  '-i' argument to interpret its output.

> I am trying to troubleshoot but cannot find anything that looks obvious in
> either my
>  */var/log/audit/audit.log* or my */var/log/messages* files.
> 
> I am working on a Puppet Module to implement this stuff and I am not sure
> if I am running into a conflict of restarting the auditd service after
> either/both of the files /etc/audit/audit.rules or /etc/audit/auditd.conf
> are updated.

Its a mode rather than a counter.

-Steve