Re: Setting priority to auditd rule files
Hello,
On Monday, January 30, 2023 12:21:53 AM EST Anurag Aggarwal wrote:
As per my understanding, currently auditd picks up rule files as per
alphabetical order.
Auditd picks up the rules in /etc/audit/audit.rules That in turn is compiled
by augenrules which uses the order as given from "ls -v".
Is there a way to force auditd to prioritize which rule file should
be
first read and applied, other than renaming it as 000-<app>.rules and
hoping that customers don't have anything lexicographically smaller than
this?
You can use "ls -v" to figure out how to make a rule that is ahead of 10-base-
config.rules. even 10-a.rule should go first. Or you can rename 10-base-
config.rules to be a higher number.
-Steve