Re: Bad Rule?
Ah! that was a typo in my email typing, since I could not copy paste from
where the syntax was to my email I was typing.
Thanks Steve.
--------------------------
Warron French
On Thu, Jul 8, 2021 at 11:11 AM Steve Grubb <sgrubb(a)redhat.com> wrote:
On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote:
> I am required to place the following rule into my audit configurations,
but
> when I do auditd will stop loading rules from this particular rule
forward
> to the end.
>
> -a always,exit -F path= /etc/NetworkManager/ -F perm=wa -F
> key=system-locale
There is a space between path= and /etc. Usually systemd puts auditctl
messages in syslog/journal.
-Steve
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://listman.redhat.com/mailman/listinfo/linux-audit
Attachments:
- attachment.html (text/html — 1.6 KB)