Re: -w deprecation and -F dir= equivalence

I tried to build from the git repository from master, and still observed the same behavior. There is a comment in the code mentionning legacy kernels so I also installed a newer kernel (6.12.96 -> 7.0.13), same error. I trimmed down the rules to the following: ## This file is automatically generated from /etc/audit/rules.d -D -b 8192 -f 1 --backlog_wait_time 60000 -c -a always,exit -F dir=/nonexitent -F perm=wa -k nonexistent The output of `augenrules --load` is: No rules enabled 1 failure 1 pid 1591 rate_limit 0 backlog_limit 8192 lost 0 backlog 5 backlog_wait_time 60000 backlog_wait_time_actual 0 enabled 1 failure 1 pid 1591 rate_limit 0 backlog_limit 8192 lost 0 backlog 5 backlog_wait_time 60000 backlog_wait_time_actual 0 enabled 1 failure 1 pid 1591 rate_limit 0 backlog_limit 8192 lost 0 backlog 5 backlog_wait_time 60000 backlog_wait_time_actual 0 Error sending add rule data request (No such file or directory) There was an error in line 7 of /etc/audit/audit.rules Thanks for the clarification. I was using `-F path|dir` with `-S all`, which I understand now, was defaiting the purpose of the change. -Seth