All, When stopping auditd during a system shutdown, I see the following error: Error deleting rule (Operation not permitted) My audit.rules file looks like: ------------------------ -D [trimmed] -a always,exit -F arch=b32 -S open -S openat -F exit=-EPERM -k access4 -w /etc/sudoers -p wa -k actions -p wax [trimmed] -e 2 ------------------------ The only ways I've found to fix this is to remove the -e 2 option, but we need our rules to be immutable? Also based on looking at the auditd init script, setting AUDITD_CLEAN_STOP=no during shutdown would work, but I don't want to modify the script. Any other ideas? Thanks. - Daniel