Have you tried making hard links to the files just to see if that works? Kevin Boyce Northrop Grumman Corp. 2000 W. Nasa Blvd. D01/222 Melbourne, Fl. 32902 kevin.boyce(a)ngc.com -----Original Message----- From: linux-audit-bounces(a)redhat.com [mailto:linux-audit-bounces@redhat.com] On Behalf Of Smith, Steven G (Steven) Sent: Tuesday, November 07, 2006 11:23 AM To: linux-audit(a)redhat.com Subject: auditd fails to start when rules and conf file are symbolic links Hey everyone, I'm seeing some strange behavior when attempting to start the auditd daemon. When I make the /etc/audit.rules and /etc/auditd.conf files symbolic links, the service fails saying that it cannot open /etc/audit.rules because of too many levels of symbolic links: [root@bling etc]# ll /etc/audit* lrwxrwxrwx 1 root root 25 Nov 7 08:22 /etc/auditd.conf -> /diskroot/etc/auditd.conf lrwxrwxrwx 1 root root 25 Nov 7 08:22 /etc/audit.rules -> /diskroot/etc/audit.rules [root@bling etc]# service auditd start Starting auditd: Error opening /etc/audit.rules (Too many levels of symbolic links) [root@acidsnowflake etc]# Note that there is nothing special about this particular diskroot directory (i.e. there are no other symbolic links involved). If I remove the symbolic links, the service works fine. The problem is that I need to have the links there for various reasons. Is this a bug in auditd, or did I do something stupid? One last note, if I vi the file via the symbolic link, it works fine, which leads me to believe that this is more likely something wrong in the startup sequence or auditd itself (although I couldn't see any issues that stood out to me). Thanks, Steve -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit