General Audit Troubleshooting
Issue
- When I attempt to restart
auditd
in RHEL 7 I get an error - When I make a change to my
/etc/audit/audit.rules
file my changes are not taking affect. - My audit rules keep getting over written.
- I have a new audit rule in place, but when I test it, I do not see the proper output in the audit logs.
Environment
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.