Re: audit.rules not fully loading into memory according to auditctl -l

Yes, certainly. I had a 1.7GB messages file in /var/log; so I moved it manually out of the way. Then I rebooted. After doing that, I didn't see anything at all about auditd in the new /var/log/messages.

I have finally gotten it down to 13 audit rules, all still Action Rules only for some reason, that are not loading into memory from /etc/audit/audit.rules. Those action rules are using -F path= attributes. What is really interesting is that I have other action rules using -F path= that are getting into memory! These are the files that are not: /usr/libexec/kde4/kdesud /usr/libexec/openssh/ssh-keysign /usr/libexec/polkit-1/polkit-agent-helper-1 /usr/libexec/pt_chown /usr/libexec/utempter/utempter /usr/lib/vmware-tools/bin32/vmware-user-suid-wrapper /usr/lib/vmware-tools/bin64/vmware-user-suid-wrapper /usr/sbin/lockdev /usr/sbin/postdrop /usr/sbin/postqueue /usr/sbin/suexec /usr/sbin/userhelper /usr/sbin/usernetctl I did the following to evaluate--- for FIL in `cat audit_action_rules_File | grep -v "^#" | awk '{ print $4 }' | cut -d= -f 2`; do echo "Checking for ${FIL}." if [ -f ${FIL} ]; then echo "${FIL} is present." else echo "The file ${FIL} is not present." fi done