audit.rules "-e 2" not working
Issue
- I have RHEL5 installs and am trying to set the audit rules immutable with the "-e 2" option as the last line in /etc/audit/audit.rules.
But when I restart audit with "service audit restart", it comes back with:
error sending enable request (Invalid argument)
There was an error in line XX of the /etc/audit.audit.rules
- If I run the command:
# auditctl -e 2
I get
error sending enable request (Invalid argument)
Environment
- Red Hat Enterprise Linux 5.x
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.