auditd message "The audit system is in immutable mode, no rules loaded"
Issue
-
When loading a new
auditdrule it fails with a message similar to the following:# auditctl -w /tmp/test -p war -k monitor-test The audit system is in immutable mode, no rule changes allowed -
messages would be printed on the system logs as well:
auditctl[PID]: The audit system is in immutable mode, no rule changes allowed
Environment
- Red Hat Enterprise Linux
auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.