You might see this note twice, I sent it through my new account (in Text), but the new account is waiting approval by the moderator still, so it might pop on the mailing list once approved (Small addition to this note, labeled NEW)

I just updated to kernel.28, and latest audit-0.7.3
Now, I am unable to create any watches. Here is what I get:
[root@comp1 objident]# auditctl -w /tmp/file1
Error sending watch insert request (Invalid argument)
Error sending rule to kernel

NEW:
[root@comp1 objident]# auditctl -w /tmp/delete_logs (file already exists)
Error sending watch insert request (Cannot allocate memory)
Error sending rule to kernel

Using the kernel.20 and audit-0.7.3, I get:
[root@comp1 objident]# auditctl -w /tmp/temp_file
Error sending watch insert request(Bad address)
Error sending rule to kernel

using kernel.20 and audit-0.7.2:
Works fine

Has anybody else seen this yet?

- loulwa