Re: -a never,exit still being logged

On Thursday, November 19, 2020 1:43:34 PM EST Andreas Hasenack wrote: > Why is it being logged, given that it matches the second (and last) rule I > have? These two events are considered kernel configuration changes. Which means that they do not originate via the SYSCALL rule engine. The -a never,exit technique works only when the event is generated as a result of other SYSCALL rules. Normally you would place that higher up so it matches first. In this case, what you would want to do is suppress it using the exclude filter: -a always,exclude -F msgtype=NETFILTER_CFG That should fix it.