Re: [RFC][PATCH] (#6) filesystem auditing

Hmmm, I'm getting this now too: ./auditctl -w /audit/foo Error sending netlink packet (Connection refused) Error sending rule to kernel ./auditd -f Config file /etc/auditd.conf opened for parsing log_file_parser called with: /var/log/audit.log log_format_parser called with: RAW flush_parser called with: DATA freq_parser called with: 0 num_logs_parser called with: 5 max_log_size_parser called with: 10 max_log_size_action_parser called with: ROTATE space_left_parser called with: 75 space_action_parser called with: SYSLOG admin_space_left_parser called with: 50 admin_space_left_action_parser called with: SUSPEND disk_full_action_parser called with: SUSPEND type=DAEMON msg=auditd(1110908991) auditd start, format=raw, pid=9805, uid=0 Error sending netlink packet (Connection refused) type=DAEMON msg=auditd(1110908991) auditd error halt, pid=9805, uid=0 Unable to set audit pid, exiting The audit daemon is exiting. Error sending netlink packet (Connection refused) This is strange, let me investigate. -tim