From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Double addition of rule yields two log messages
Date: Fri, 19 May 2006 15:01:37 -0400
Message-ID: <200605191501.38031.sgrubb@redhat.com>
References: <446DE295.8040503@us.ibm.com>
	<200605191429.18451.sgrubb@redhat.com> <446E12D1.2060709@hp.com>
Mime-Version: 1.0
Content-Type: text/plain;
  charset="iso-8859-1"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <446E12D1.2060709@hp.com>
Content-Disposition: inline
List-Unsubscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: Linda Knippers <linda.knippers@hp.com>
Cc: linux-audit@redhat.com
List-Id: linux-audit@redhat.com

On Friday 19 May 2006 14:47, Linda Knippers wrote:
> But why does ausearch care?

Ausearch doesn't care about this particular setting. Its looking at the config 
to find the log files. The parser is what cares and it is what emitted this 
warning. As such, you can use ausearch to make sure your config is sane 
before sending sighup to reconfigure the audit daemon.

> Seems like if anything cared it would be the auditd but I can't find an
> error or warning from it anywhere.

Should be in the syslog.

-Steve