From mboxrd@z Thu Jan  1 00:00:00 1970
From: Steve Grubb <sgrubb@redhat.com>
Subject: Re: Security audit rules
Date: Fri, 22 Nov 2019 12:08:31 -0500
Message-ID: <2526162.J9WsBpnIYZ@x2>
References: <AM0PR07MB414818424612036066D01E9BB27B0@AM0PR07MB4148.eurprd07.prod.outlook.com>
	<20191119223243.inqd4yz5dsnr6gpg@madcap2.tricolour.ca>
	<AM0PR07MB4148C22E0204056F7EB36DC7B24F0@AM0PR07MB4148.eurprd07.prod.outlook.com>
Mime-Version: 1.0
Content-Type: text/plain; charset="us-ascii"
Content-Transfer-Encoding: 7bit
Return-path: <linux-audit-bounces@redhat.com>
In-Reply-To: <AM0PR07MB4148C22E0204056F7EB36DC7B24F0@AM0PR07MB4148.eurprd07.prod.outlook.com>
List-Unsubscribe: <https://www.redhat.com/mailman/options/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=unsubscribe>
List-Archive: <https://www.redhat.com/archives/linux-audit>
List-Post: <mailto:linux-audit@redhat.com>
List-Help: <mailto:linux-audit-request@redhat.com?subject=help>
List-Subscribe: <https://www.redhat.com/mailman/listinfo/linux-audit>,
	<mailto:linux-audit-request@redhat.com?subject=subscribe>
Sender: linux-audit-bounces@redhat.com
Errors-To: linux-audit-bounces@redhat.com
To: linux-audit@redhat.com
Cc: Richard Guy Briggs <rgb@redhat.com>, "Kadirvadivelu,
	Vezhavendan 1. (EXT - IN/Chennai)" <vezhavendan.1.kadirvadivelu.ext@nokia.com>
List-Id: linux-audit@redhat.com

On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. 
(EXT - IN/Chennai) wrote:
> I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).

This distribution wants rules placed in /etc/audit/rules.d/
The audit package should have a file named README-rules that explains what is 
expected.

-Steve

> -----Original Message-----
> From: Richard Guy Briggs <rgb@redhat.com>
> Sent: Wednesday, November 20, 2019 4:03 AM
> To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)
> <vezhavendan.1.kadirvadivelu.ext@nokia.com> Cc: linux-audit@redhat.com
> Subject: Re: Security audit rules
> 
> On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) 
wrote:
> > Hi,
> > 
> > In one of the VM I find audit.rules defined under /etc/audit as well as
> > /etc/audit/rules.d.
> > 
> > What is the significance as well as difference between the files found in
> > 2 places.
> You haven't said what distro you are using.  In more recent distros, the
> rules in rules.d are used by augenrules to populate audit.rules,
> overwriting them.
> > Also please let me know what is the correct location where audit.rules
> > need to be places.
> Depends on your distro.
> 
> > Vezhavendan K
> 
> - RGB
> 
> --
> Richard Guy Briggs <rgb@redhat.com>
> Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa,
> Red Hat Canada IRC: rgb, SunRaycer
> Voice: +1.647.777.2635, Internal: (81) 32635
> 
> 
> --
> Linux-audit mailing list
> Linux-audit@redhat.com
> https://www.redhat.com/mailman/listinfo/linux-audit