9:18 a.m.
It appears that this directory is not used at all on RHEL6.
I know I have mentioned this before; but it's true. If I *move* my copy of
audit.rules from /etc/audit into the subdirectory rules.d and restart
audit; the audit.rules file is not recopied/regenerated or whatever by the
auditd.
This behavior is different from RHEL7; where if you delete the
/etc/audit/audit.rules file or move it to /etc/audit/rules.d/audit.rules;
the auditd functions as I expect.
Can someone please correct my understanding? Is the /etc/audit/rules.d
directory not supposed to be usable in RHEL6; but is in RHEL7?
--------------------------
Warron French
9:25 a.m.
There is a different default setting between rhel6 and 7. See /etc/default/auditd I think
has a parameter that controls the use of /etc/audit/rules.d.
Sent from my mobile phone, please excuse the brevity.
On Apr 12, 2017, 7:19 AM, at 7:19 AM, "warron.french"
<warron.french(a)gmail.com> wrote:
It appears that this directory is not used at all on RHEL6.
I know I have mentioned this before; but it's true. If I *move* my
copy of
audit.rules from /etc/audit into the subdirectory rules.d and restart
audit; the audit.rules file is not recopied/regenerated or whatever by
the
auditd.
This behavior is different from RHEL7; where if you delete the
/etc/audit/audit.rules file or move it to
/etc/audit/rules.d/audit.rules;
the auditd functions as I expect.
Can someone please correct my understanding? Is the /etc/audit/rules.d
directory not supposed to be usable in RHEL6; but is in RHEL7?
--------------------------
Warron French
------------------------------------------------------------------------
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
9:33 a.m.
----- Original Message -----
From: "warron.french" <warron.french(a)gmail.com>
To: linux-audit(a)redhat.com
Sent: Wednesday, April 12, 2017 10:18:55 AM
Subject: rules.d on RHEL6
It appears that this directory is not used at all on RHEL6.
I know I have mentioned this before; but it's true. If I move my copy of
audit.rules from /etc/audit into the subdirectory rules.d and restart audit;
the audit.rules file is not recopied/regenerated or whatever by the auditd.
This behavior is different from RHEL7; where if you delete the
/etc/audit/audit.rules file or move it to /etc/audit/rules.d/audit.rules;
the auditd functions as I expect.
Can someone please correct my understanding? Is the /etc/audit/rules.d
directory not supposed to be usable in RHEL6; but is in RHEL7?
Its usable but you have to run
# augenrules --load
Note that this will overwrite /etc/audit/audit.rules
--------------------------
Warron French
--
Linux-audit mailing list
Linux-audit(a)redhat.com
https://www.redhat.com/mailman/listinfo/linux-audit
--
Simon Sekidde * Red Hat, Inc. * Tyson's Corner, VA
Solution Architect, NA Public Sector
gpg: 5848 958E 73BA 04D3 7C06 F096 1BA1 2DBF 94BC 377E
10:51 a.m.
On Wednesday, April 12, 2017 10:18:55 AM EDT warron.french wrote:
It appears that this directory is not used at all on RHEL6.
I know I have mentioned this before; but it's true. If I *move* my copy of
audit.rules from /etc/audit into the subdirectory rules.d and restart
audit; the audit.rules file is not recopied/regenerated or whatever by the
auditd.
This behavior is different from RHEL7; where if you delete the
/etc/audit/audit.rules file or move it to /etc/audit/rules.d/audit.rules;
the auditd functions as I expect.
This is mostly correct. The issue with RHEL 6 is that the augenrules program
didn't exist when RHEL 6 was originally shipped. So, it would have been bad
and unexpected for the behavior to suddenly change during an update to a
shipped product. However, augenrules is useful and for anyone that wants to
use it on RHEL 6 they may do so by opting in.
If you read the text in /etc/sysconfig/auditd you will see an explanation of
how to enable augenrules.
-Steve
Can someone please correct my understanding? Is the
/etc/audit/rules.d
directory not supposed to be usable in RHEL6; but is in RHEL7?
--------------------------
Warron French
2810
days inactive
2810
days old
linux-audit@lists.linux-audit.osci.io
3 comments
4 participants
participants (4)
-
Bond Masuda -
Simon Sekidde -
Steve Grubb -
warron.french