On 2021-07-08 13:33, warron.french wrote:
> Ah! that was a typo in my email typing, since I could not copy paste from
> where the syntax was to my email I was typing.

Could it be you are trying to add a directory with a path field?

> Thanks Steve.
> --------------------------
> Warron French
>
> On Thu, Jul 8, 2021 at 11:11 AM Steve Grubb <sgrubb@redhat.com> wrote:
> > On Thursday, July 8, 2021 10:26:57 AM EDT warron.french wrote:
> > > I am required to place the following rule into my audit configurations,
> > but
> > > when I do auditd will stop loading rules from this particular rule
> > forward
> > > to the end.
> > >
> > > -a always,exit  -F path= /etc/NetworkManager/  -F perm=wa  -F
> > > key=system-locale

-a always,exit -F dir=/etc/NetworkManager/ -F perm=wa -F key=system-locale

> > There is a space between path=  and /etc. Usually systemd puts auditctl
> > messages in syslog/journal.
> >
> > -Steve

- RGB

--
Richard Guy Briggs <rgb@redhat.com>
Sr. S/W Engineer, Kernel Security, Base Operating Systems
Remote, Ottawa, Red Hat Canada
IRC: rgb, SunRaycer
Voice: +1.647.777.2635, Internal: (81) 32635