From mboxrd@z Thu Jan 1 00:00:00 1970 From: Robert Evans Subject: Re: Why aren't SYSCALLS being logged in CentOS kernel (any ideas?) Date: Fri, 31 Aug 2007 13:51:03 -0400 Message-ID: <46D85507.1040605@jhuapl.edu> References: <46D83657.1060503@jhuapl.edu> <200708311202.44410.sgrubb@redhat.com> <46D8515A.2070806@jhuapl.edu> <200708311340.25209.sgrubb@redhat.com> Mime-Version: 1.0 Content-Type: text/plain; charset=ISO-8859-1; format=flowed Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <200708311340.25209.sgrubb@redhat.com> List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb Cc: linux-audit@redhat.com List-Id: linux-audit@redhat.com Steve, Once again...Thank you very much. I did not realize that audit.rules had been placed in a new location. I moved audit.rules to /etc/audit, restarted auditd and everything looks like it works fine. Much thanks again! Bob Steve Grubb wrote: > On Friday 31 August 2007 13:35:22 Robert Evans wrote: > > Hmmm....tried auditctl -l and just got > > > > No rules > > OK, that's a start. > > > Since I have /etc/audit.rules in place, does that indicate the syscall > > auditing part of the kernel is compiled in. > > Well, that file is for user space. But on RHEL5, that file's location has > changed. So maybe that is your problem? It should be: > > /etc/audit/audit.rules > > But, you can load the rules where they are by hand: > > auditctl -R /etc/audit.rules > > to make sure its working. See if that doesn't fix your problem. > > -Steve >