Hi,<div><br></div><div>I added the following rules in audit.rules for monitoring auditd/audispd be killed(audit ver: 1.8),</div><div>=============</div><div>-a exit,always -F perm=wa -F path=/var/run/auditd.pid -k cfg</div><br><div>-a exit,always -F perm=wa -F path=/var/run/audispd_events -k cfg<br></div><div><br></div><div>Or</div><div>-a exit,always -S kill -F path=/var/run/auditd.pid -k cfg<br></div><div><br></div><div>-a exit,always -S kill -F path=/var/run/audispd_events -k cfg<br></div><div>=============<br></div><div><br></div><div>However, these rules don&#39;t work: even the processes (auditd/audispd) are killed, I can&#39;t get any related messages except DAEMON_END.</div><div><br></div><div><br></div>