On Tue, 2 Feb 2016 12:05:38 -0500 leam hall <leamhall(a)gmail.com&gt; wrote: > Running into errors where we're pushing out a blanket audit.rules > file and some servers don't have some of the files. I've seen the -i > and -c suggestion for auditctl but wanted to confirm that that's the > right choice. We need to ensure warnings don't choke auditd or make > it skip other rules. -c will make it continue but ultimately report failure. -i will make it continue and pretend nothing is wrong. Either could be correct depending on whether you want success or failure final status. -Steve