From mboxrd@z Thu Jan 1 00:00:00 1970 From: Bo Subject: Audit not taking rules Date: Wed, 2 Jul 2008 16:44:49 -0600 Message-ID: Mime-Version: 1.0 Content-Type: multipart/mixed; boundary="===============1869579443==" Return-path: Received: from mx3.redhat.com (mx3.redhat.com [172.16.48.32]) by int-mx1.corp.redhat.com (8.13.1/8.13.1) with ESMTP id m62Mj1gt022585 for ; Wed, 2 Jul 2008 18:45:01 -0400 Received: from yx-out-2324.google.com (yx-out-2324.google.com [74.125.44.30]) by mx3.redhat.com (8.13.8/8.13.8) with ESMTP id m62Minbi024301 for ; Wed, 2 Jul 2008 18:44:50 -0400 Received: by yx-out-2324.google.com with SMTP id 3so180702yxj.81 for ; Wed, 02 Jul 2008 15:44:49 -0700 (PDT) List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Sender: linux-audit-bounces@redhat.com Errors-To: linux-audit-bounces@redhat.com To: linux-audit@redhat.com List-Id: linux-audit@redhat.com --===============1869579443== Content-Type: multipart/alternative; boundary="----=_Part_6271_13163292.1215038689542" ------=_Part_6271_13163292.1215038689542 Content-Type: text/plain; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline I have RHEL 4 install (update 5). aureport seems to be working, so as the /var/log/audit/audit.log however auditd does not take any of my watch rules [root@master ~]# service auditd restart Stopping auditd: [ OK ] Starting auditd: [ OK ] Error sending watch insert request (Invalid argument) There was an error in line 26 of /etc/audit.rules When do auditctl -l, [root@master ~]# auditctl -l No rules File system watches not supported Can anyone point me to a solution? audit version 1.0.15 kernel 2.6.22.5 here is my audit.rules ## Remove any existing rules -D ## Increase buffer size to handle the increased number of messages. ## Feel free to increase this if the machine panic's -b 1024 ## Set failure mode to panic -f 2 -w /boot -p wa ------=_Part_6271_13163292.1215038689542 Content-Type: text/html; charset=ISO-8859-1 Content-Transfer-Encoding: 7bit Content-Disposition: inline I have RHEL 4 install (update 5).
aureport seems to be working, so as the /var/log/audit/audit.log
however auditd does not take any of my watch rules
[root@master ~]# service auditd restart
Stopping auditd:                                           [  OK  ]
Starting auditd:                                           [  OK  ]
Error sending watch insert request (Invalid argument)
There was an error in line 26 of /etc/audit.rules

When do auditctl -l,
[root@master ~]# auditctl -l
No rules
File system watches not supported

Can anyone point me to a solution?
audit version 1.0.15
kernel 2.6.22.5

here is my audit.rules
## Remove any existing rules
-D

## Increase buffer size to handle the increased number of messages.
## Feel free to increase this if the machine panic's
-b 1024

## Set failure mode to panic
-f 2

-w /boot -p wa


------=_Part_6271_13163292.1215038689542-- --===============1869579443== Content-Type: text/plain; charset="us-ascii" MIME-Version: 1.0 Content-Transfer-Encoding: 7bit Content-Disposition: inline --===============1869579443==--