On Monday, January 20, 2020 9:24:56 AM EST Leam Hall wrote: > If /etc/audit/auditd.conf encounters conflicting duplicate settings, > what happens? Takes the first, takes the last, or what? For example: > > space_left = 25 > space_left = 100 It overwrites the first value with the second one. You can also run: # service auditd state to see what the current value is if your audit daemon is somewhat recent.

On Monday, January 20, 2020 9:24:56 AM EST Leam Hall wrote: > If /etc/audit/auditd.conf encounters conflicting duplicate settings, > what happens? Takes the first, takes the last, or what? For example: > > space_left = 25 > space_left = 100 It overwrites the first value with the second one. You can also run: # service auditd state to see what the current value is if your audit daemon is somewhat recent. -Steve

On Monday, January 20, 2020 10:04:24 AM EST Leam Hall wrote: > On 1/20/20 9:37 AM, Steve Grubb wrote: >> On Monday, January 20, 2020 9:24:56 AM EST Leam Hall wrote: >>> If /etc/audit/auditd.conf encounters conflicting duplicate settings, >>> what happens? Takes the first, takes the last, or what? For example: >>> >>> space_left = 25 >>> space_left = 100 >> >> It overwrites the first value with the second one. You can also run: >> >> # service auditd state >> >> to see what the current value is if your audit daemon is somewhat recent. >> >> -Steve > > Hey Steve, a follow up. Is the man page for auditd.conf wrong? My auditd > failed to start when giving space_left with a '%' sign. Usually it writes the reason why in syslog. Does it say anything there? -Steve

On Monday, January 20, 2020 10:19:59 AM EST Leam Hall wrote: > On 1/20/20 10:14 AM, Steve Grubb wrote: >> On Monday, January 20, 2020 10:04:24 AM EST Leam Hall wrote: >>> On 1/20/20 9:37 AM, Steve Grubb wrote: >>>> On Monday, January 20, 2020 9:24:56 AM EST Leam Hall wrote: >>>>> If /etc/audit/auditd.conf encounters conflicting duplicate settings, >>>>> what happens? Takes the first, takes the last, or what? For example: >>>>> >>>>> space_left = 25 >>>>> space_left = 100 >>>> >>>> It overwrites the first value with the second one. You can also run: >>>> >>>> # service auditd state >>>> >>>> to see what the current value is if your audit daemon is somewhat >>>> recent. >>> >>> Hey Steve, a follow up. Is the man page for auditd.conf wrong? My auditd >>> failed to start when giving space_left with a '%' sign. >> >> Usually it writes the reason why in syslog. Does it say anything there? > > I don't grok systemd, so here's the whole response: > > Redirecting to /bin/systemctl status auditd.service > ● auditd.service - Security Auditing Service > Loaded: loaded (/usr/lib/systemd/system/auditd.service; enabled; > vendor preset: enabled) > Active: failed (Result: exit-code) since Mon 2020-01-20 09:27:37 > EST; 19min ago > Docs: man:auditd(8) > https://github.com/linux-audit/audit-documentation > Process: 2695 ExecStart=/sbin/auditd (code=exited, status=6) > > Jan 20 09:27:36 leam_c7 systemd[1]: Starting Security Auditing Service... > Jan 20 09:27:37 leam_c7 auditd[2695]: Value 25% should only be numbers - > line 20 The issue is here ^^^ To use percentages, you have to be on 2.8.5 or later.