Re: audit.rules not fully loading into memory according to auditctl -l

On Wednesday, April 12, 2017 3:00:59 PM EDT warron.french wrote: > Yes, certainly. > > I had a 1.7GB messages file in /var/log; so I moved it manually out of the > way. Then I rebooted. > > After doing that, I didn't see anything at all about auditd in the new > /var/log/messages. It will probably be auditctl rather than auditd. Auditctl is noisy on any problems, try loading the rules by hand: auditctl -R /etc/audit/audit.rules -Steve > I have finally gotten it down to 13 audit rules, all still Action Rules > only for some reason, that are not loading into memory from > /etc/audit/audit.rules. > Those action rules are using -F path= attributes. > > What is really interesting is that I have other action rules using -F path= > that are getting into memory! > > These are the files that are not: > /usr/libexec/kde4/kdesud > /usr/libexec/openssh/ssh-keysign > /usr/libexec/polkit-1/polkit-agent-helper-1 > /usr/libexec/pt_chown > /usr/libexec/utempter/utempter > /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper > /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper > /usr/sbin/lockdev > /usr/sbin/postdrop > /usr/sbin/postqueue > /usr/sbin/suexec > /usr/sbin/userhelper > /usr/sbin/usernetctl > > I did the following to evaluate--- > for FIL in `cat audit_action_rules_File | grep -v "^#" | awk '{ print $4 }' > > | cut -d= -f 2`; do > > echo "Checking for ${FIL}." > if [ -f ${FIL} ]; then > echo "${FIL} is present." > else > echo "The file ${FIL} is not present." > fi > done