Re: Double addition of rule yields two log messages
On Friday 19 May 2006 15:28, Linda Knippers wrote:
> Ausearch doesn't care about this particular setting. Its
looking at the
> config to find the log files. The parser is what cares and it is what
> emitted this warning.
But why is it even a warning of the freq value is only valid if flush
is set to incremental?
So that you fix it.
> Should be in the syslog.
I see it after doing a HUP and when doing an /etc/init.d/auditd restart
but not when auditd starts at boot time.
Hmm. Should be there all the time or its a bug.
-Steve