Re: audit.rules not fully loading into memory according to auditctl -l

[Steve Grubb <sgrubb@redhat.com>]

On Wednesday, April 12, 2017 3:00:59 PM EDT warron.french wrote:
> Yes, certainly.
> 
> I had a 1.7GB messages file in /var/log; so I moved it manually out of the
> way.  Then I rebooted.
> 
> After doing that, I didn't see anything at all about auditd in the new
> /var/log/messages.

It will probably be auditctl rather than auditd. Auditctl is noisy on any 
problems, try loading the rules by hand:

auditctl -R /etc/audit/audit.rules

-Steve

> I have finally gotten it down to 13 audit rules, all still Action Rules
> only for some reason, that are not loading into memory from
> /etc/audit/audit.rules.
> Those action rules are using -F path= attributes.
> 
> What is really interesting is that I have other action rules using -F path=
> that are getting into memory!
> 
> These are the files that are not:
> /usr/libexec/kde4/kdesud
> /usr/libexec/openssh/ssh-keysign
> /usr/libexec/polkit-1/polkit-agent-helper-1
> /usr/libexec/pt_chown
> /usr/libexec/utempter/utempter
> /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper
> /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper
> /usr/sbin/lockdev
> /usr/sbin/postdrop
> /usr/sbin/postqueue
> /usr/sbin/suexec
> /usr/sbin/userhelper
> /usr/sbin/usernetctl
> 
> I did the following to evaluate---
> for FIL in `cat audit_action_rules_File | grep -v "^#" | awk '{ print $4 }'
> 
> | cut -d= -f 2`; do
> 
>    echo "Checking for ${FIL}."
>    if [ -f ${FIL} ]; then
>       echo "${FIL} is present."
>    else
>       echo "The file ${FIL} is not present."
>    fi
> done