Hi all,
I just grabbed the latest audit bits today, and noticed that when you
load rules from a file, auditctl outputs an ambiguous message:
# auditctl -R /tmp/rules.txt
No rules
No watches
AUDIT_STATUS: enabled=1 flag=1 pid=2908 rate_limit=0 backlog_limit=256
lost=0 backlog=1
This message should be suppressed, as it implies that the rules have
not been added, when in fact they have.
I'm also seeing an error when deleting rules, although the command is
successful:
# auditctl -D
Error receiving list (Success)
No rules
No watches
Thanks,
Amy