• Skip to primary navigation
  • Skip to main content
  • Skip to primary sidebar
  • Skip to footer navigation

The Geek Diary

  • OS
    • Linux
    • CentOS/RHEL
    • Solaris
    • Oracle Linux
    • VCS
  • Interview Questions
  • Database
    • oracle
    • oracle 12c
    • ASM
    • mysql
    • MariaDB
  • DevOps
    • Docker
    • Shell Scripting
  • Big Data
    • Hadoop
    • Cloudera
    • Hortonworks HDP

Audit Rule Configuration not Reflected – How to troubleshoot

by admin

The problem

We have added new audit rules to the configuration file /etc/audit/rules.d/audit.rules as shown below:

# vi /etc/audit/rules.d/audit.rules
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S stime -S clock_settime -k time-change
-a always,exit -F arch=b64 -S sethostname -S setdomainname -k system-locale

But, these configurations does not reflected.

# auditctl -l
No rules
Note: On CentOS/RHEL 6, the configuration file is /etc/audit/audit.rules instead of /etc/audit/rules.d/audit.rules.

The Solution

1. The first thing to check here is the rule’s syntax and correct if it is wrong. For example, you can manually run the rule you have configured in the configuration file. You should see the syntax error on the command line when you run the command. For example:

# auditctl -a always,exit -F arch=b64 -S adjtimex -S settimeofday -S stime -S clock_settime -k time-change
Syscall name unknown: stime
The audit system is in immutable mode, no rule changes allowed

2. Correct the rule argument “-S time” and restart the system. The restart is required to disable the auditd immutable mode.

3. Post reboot, all of the audit rule will reflect.

# auditctl -l
-a always,exit -F arch=x86_64 -S adjtimex,settimeofday,time,clock_settime -F key=time-change
-a always,exit -F arch=x86_64 -S sethostname,setdomainname -F key=system-locale

If you set the incorrect syntax in /etc/audit/rules.d/audit.rules configuration file, auditd stop the rule registration. So, all of the rules after incorrect syntax line, will not reflect.

Filed Under: CentOS/RHEL 6, CentOS/RHEL 7, Linux

Some more articles you might also be interested in …

  1. How to Trace Python Scripts using trace.py
  2. How to create a Python Dictionary
  3. How to find if NUMA configuration is enabled or disabled?
  4. watch command examples to run a command repeatedly or monitor dynamically changeable files (like /proc/*)
  5. Configure Network Bonding in Ubuntu Server
  6. 10pt loadable: Metric (TFM) file not found
  7. How To Disable Ksplice Service on OEL
  8. Linux OS Service ‘NetFS’
  9. “docker dead but subsys locked” – error while starting docker
  10. Configure MySQL Router to Auto Restart of Failure using systemd

You May Also Like

Primary Sidebar

Recent Posts

  • qemu-system-x86_64: command not found
  • timedatectl: command not found
  • mpirun.openmpi: command not found
  • startkde: command not found

© 2022 · The Geek Diary

  • Archives
  • Contact Us
  • Copyright