Re: Failure flag "0" doesn't work
Alex,
Can you provide a little more detail?
Perhaps your /etc/audit/auditd.conf, /etc/audit/rules.d/*, your test
case, the expected outcome and the outcome you actually get.
Regards
On Thu, 2015-08-20 at 11:09 +0300, Alex Beljanski wrote:
Hi!
We have problem in CentOS 7 with auditd.
For our servers we set failure flag 0, but kernel write messages and
we see them in dmesg.
uname -a
Linux 3.10.0-229.11.1.el7.x86_64 #1 SMP Thu Aug 6 01:06:18 UTC 2015
x86_64 x86_64 x86_64 GNU/Linux
# rpm -qa | grep audit
audit-2.4.1-5.el7.x86_64
Why this doesn't work?
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit