From mboxrd@z Thu Jan 1 00:00:00 1970 From: "Boyce, Kevin P (AS)" Subject: RE: EXT :Re: audit.rules setting Date: Tue, 22 Mar 2016 14:26:33 +0000 Message-ID: References: <3733418.XMMLLTDFfX@x2> Mime-Version: 1.0 Content-Type: text/plain; charset="us-ascii" Content-Transfer-Encoding: 7bit Return-path: In-Reply-To: <3733418.XMMLLTDFfX@x2> Content-Language: en-US List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: Steve Grubb , "linux-audit@redhat.com" List-Id: linux-audit@redhat.com With regard to this subject I don't know if it is possible, but it bothers me when shutting down a system that you get errors (when -e 2 is enabled) when auditd is stopping. That might be unavoidable though. Kevin Boyce -----Original Message----- From: linux-audit-bounces@redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Steve Grubb Sent: Tuesday, March 22, 2016 10:06 AM To: linux-audit@redhat.com Subject: EXT :Re: audit.rules setting On Tuesday, March 22, 2016 12:55:25 PM Warron S French wrote: > Does the "-e 2" have to be the last line of the audit.rules file? Yes. Once its sent to the kernel, the kernel rules tables are immutable. > Does it have to be listed prior to all of the syscalls and watches > configured in the file? No. This will make it not load anything. -Steve -- Linux-audit mailing list Linux-audit@redhat.com https://www.redhat.com/mailman/listinfo/linux-audit