auditd message "The audit system is in immutable mode, no rules loaded"
Issue
-
When loading a new
auditd
rule it fails with a message similar to the following:# auditctl -w /tmp/test -p war -k monitor-test The audit system is in immutable mode, no rule changes allowed
Environment
- Red Hat Enterprise Linux
auditd
Subscriber exclusive content
A Red Hat subscription provides unlimited access to our knowledgebase, tools, and much more.