I have RHEL 4 install (update 5). <br>aureport seems to be working, so as the /var/log/audit/audit.log<br>however auditd does not take any of my watch rules<br>[root@master ~]# service auditd restart<br>Stopping auditd:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&nbsp; OK&nbsp; ]<br>
Starting auditd:&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp; [&nbsp; OK&nbsp; ]<br>Error sending watch insert request (Invalid argument)<br>There was an error in line 26 of /etc/audit.rules<br><br>When do auditctl -l, <br>[root@master ~]# auditctl -l<br>
No rules<br>File system watches not supported<br><br>Can anyone point me to a solution?<br>audit version 1.0.15<br>kernel <a href="http://2.6.22.5">2.6.22.5</a><br><br>here is my audit.rules<br>## Remove any existing rules<br>
-D<br><br>## Increase buffer size to handle the increased number of messages.<br>## Feel free to increase this if the machine panic&#39;s<br>-b 1024<br><br>## Set failure mode to panic<br>-f 2<br><br>-w /boot -p wa<br><br>
<br>