Re: "Error sending add rule request" using 1.5.4
On Wednesday 09 January 2008 14:01:39 Brennan, William C wrote:
I'm attempting to use the auditd package (1.5.4) as supplied
downstream
in the Ubuntu distribution. I'm encountering a problem (as a few others
are as well, Ubuntu bug #140784) in that we can't get auditctl to
successfully handle any new rules. For me, this version of auditd has
not worked at all.
I'd start with asking if the kernel supports auditing. Auditctl has no
dependencies on anything in userspace aside from a normal glibc.
-Steve