Hi, I was testing the new watch system and ran across some problems. When I loaded 85 watches + 10 syscall rules, I got this when trying to list them back out: [root@localhost watch-perf]# auditctl -l Error receiving audit netlink packet (No buffer space available) Error sending rule list request (No buffer space available) And when I try to add a watch against a file in my home directory, I get this: [root@localhost watch-perf]# auditctl -w /root/test/watch-perf/error.txt Error sending add rule request (Permission denied) If I move the same file to /etc, it works fine. I ran strace to see where this is coming from: sendto(3, "@\4\0\0\363\3\5\0\1\0\0\0\0\0\0\0\4\0\0\0\2\0\0\0\1\0\0"..., 1088, 0, {sa_family=AF_NETLINK, pid=0, groups=00000000}, 12) = 1088 poll([{fd=3, events=POLLIN, revents=POLLIN}], 1, 100) = 1 recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"..., 8476, MSG_PEEK|MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 recvfrom(3, "$\0\0\0\2\0\0\0\1\0\0\0\261\10\0\0\363\377\377\377@\4\0"..., 8476, MSG_DONTWAIT, {sa_family=AF_NETLINK, pid=0, groups=00000000}, [12]) = 36 write(2, "Error sending add rule request ("..., 50Error sending add rule request (Permission denied)) = 50 Looks like the kernel to me. This is using the lspp.16 kernel. -Steve -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit