Hello, I am writing a Puppet Module to deliver updates of audit.rules and auditd.conf configurations to RHEL6 and RHEL7 machines.

The files are laid down correctly for both RHEL6 and RHEL7 within the appropriate directories:

RHEL6 = /etc/audit/audit.rules, for
RHEL7 = /etc/audit/rules.d/audit.rules

Anyway, the results for all RHEL7 machines (client versus Server) are perfect. The audit.rules are all laid down as expected, and after a reboot of the system the rules are all 100% in place - just as I need.

The problem is when they are laid down on RHEL6 clients versus Servers, the behaviors are very different.

For RHEL6 clients I have the following intentions and loaded into memory:

118 (-a) Action Rules in audit.rules file 118 Action Rules are loaded into memory (YAY!)

15 (-w) Watch Rules in audit.rules file 15 Watch Rules are loaded into memory (YAY!)

133 Total Rules in audit.rules files 133 Total Rules into memory (YAY!)

For RHEL6 Server; however, I have the following results:

118 (-a) Action Rules in audit.rules file 105 Action Rules are loaded into memory (FAIL)

15 (-w) Watch Rules in audit.rules file 0 Watch Rules are loaded into memory (HUGE FAIL)

133 Total Rules in audit.rules files 105 Total Rules into memory (YAY!)

This is really a big problem for me. Can someone help?

--------------------------
Warron French