Hi, In one of the VM I find audit.rules defined under /etc/audit as well as /etc/audit/rules.d. What is the significance as well as difference between the files found in 2 places.

Also please let me know what is the correct location where audit.rules need to be places.

Vezhavendan K

I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)).

-----Original Message----- From: Richard Guy Briggs <rgb(a)redhat.com&gt; Sent: Wednesday, November 20, 2019 4:03 AM To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext(a)nokia.com&gt; Cc: linux-audit(a)redhat.com Subject: Re: Security audit rules On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai)

> Hi, > > In one of the VM I find audit.rules defined under /etc/audit as well > as /etc/audit/rules.d. > > What is the significance as well as difference between the files > found in > 2 places. You haven't said what distro you are using. In more recent distros, the rules in rules.d are used by augenrules to populate audit.rules, overwriting them. > Also please let me know what is the correct location where > audit.rules need to be places. Depends on your distro. > Vezhavendan K - RGB -- Richard Guy Briggs <rgb(a)redhat.com&gt; Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, Ottawa, Red Hat Canada IRC: rgb, SunRaycer Voice: +1.647.777.2635, Internal: (81) 32635 -- Linux-audit mailing list Linux-audit(a)redhat.com https://www.redhat.com/mailman/listinfo/linux-audit

That's clear on the rules. Thanks for that, but my question is where should I place the file called 'audit.rules'. It should be under '/etc/audit' or '/etc/audit/rules.d' or in both places.

-----Original Message----- From: Steve Grubb <sgrubb(a)redhat.com&gt; Sent: Friday, November 22, 2019 10:39 PM To: linux-audit(a)redhat.com Cc: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) <vezhavendan.1.kadirvadivelu.ext(a)nokia.com>; Richard Guy Briggs <rgb(a)redhat.com&gt; Subject: Re: Security audit rules On Tuesday, November 19, 2019 11:36:38 PM EST Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) wrote: > I am using RHEL7.6 version (Red Hat Enterprise Linux 7 (Maipo)). This distribution wants rules placed in /etc/audit/rules.d/ The audit package should have a file named README-rules that explains what is expected. -Steve > -----Original Message----- > From: Richard Guy Briggs <rgb(a)redhat.com&gt; > Sent: Wednesday, November 20, 2019 4:03 AM > To: Kadirvadivelu, Vezhavendan 1. (EXT - IN/Chennai) > <vezhavendan.1.kadirvadivelu.ext(a)nokia.com&gt; Cc: > linux-audit(a)redhat.com > Subject: Re: Security audit rules > > On 2019-11-08 12:52, Kadirvadivelu, Vezhavendan 1. (EXT - > IN/Chennai) wrote: > > Hi, > > > > In one of the VM I find audit.rules defined under /etc/audit as > > well as /etc/audit/rules.d. > > > > What is the significance as well as difference between the files > > found in > > 2 places. > > You haven't said what distro you are using. In more recent distros, > the rules in rules.d are used by augenrules to populate audit.rules, > overwriting them. > > > Also please let me know what is the correct location where > > audit.rules need to be places. > > Depends on your distro. > > > Vezhavendan K > > - RGB > > -- > Richard Guy Briggs <rgb(a)redhat.com&gt; > Sr. S/W Engineer, Kernel Security, Base Operating Systems Remote, > Ottawa, Red Hat Canada IRC: rgb, SunRaycer > Voice: +1.647.777.2635, Internal: (81) 32635 > > > -- > Linux-audit mailing list > Linux-audit(a)redhat.com > https://www.redhat.com/mailman/listinfo/linux-audit