Re: No audit records on FC5-t3 when arch is specified
Amy Griffis wrote:
I just experienced the same problem when specifying a rule with the
'inode' field. I suspect this is because the support for the new
operators was added to auditctl in audit-1.1.1 and does not exist in
the FC5-t3 kernel. If you downgrade your audit packages to the
1.0 stream, do you still see the problem?
Thanks Amy for the suggestion ...
downgrading audit to 1.0 stream fixed the problem I was having.
- Loulwa