On Saturday, February 27, 2016 12:22:05 AM 张晨峰 wrote: Its assumed that the audit system is installed on a managed system. That means that it depends on the admin or the OS distribution to provide its basic needs. With that assumption, one would then only verify that the path exists so that if open(2) later fails, you can correctly tell the admin why the audit system cannot be started. The audit system _could_ make the directory. But what if its a typo? (e.g. /vr/log/audit) Should auditd make the whole directory hierarchy all the way to the last directory? What permissions should the directory (or directories) have? What should be the owner and group? If those don't exist, should the audit system make the accounts? What if the directory chosen is not labeled correctly for SE Linux? Should auditd have knowledge of SE Linux policy and call semanage to fix that? What about other MAC systems? I really just want to draw the line and say its the admin's responsibility to correctly set it up and then only verify the essentials so that a meaningful and actionable problem is reported. :-) Hope this helps... -Steve